U-Turn stopped working after update

[SteveRuberti]

After Updating PA850 to 10.1.3, U-Turn to 2019 webserver is no longer working.

Firefox Message:

Secure Connection Failed

An error occurred during a connection to wdafire.townshipofhamilton.com. PR_CONNECT_RESET_ERROR

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.

I have an open ticket for this issue, looking to see if anyone else is experiencing the same problem.

[kiwi]

Hi @SteveRuberti ,

I've seen this error when the webserver didn't support TLSv1.3 but the FW was set to use minimum version TLSv1.3 : https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption-concepts/tlsv13-ssl...

Any more details in the decryption logs that can provide more information ?

Cheers !

-Kiwi.

[SteveRuberti]

-Kiwi,

 Thanks for your reply. The site can be accessed externally. The failure occurs on LAN computers using the U-Turn.

I am currently leaning toward a TLS problem based on wireshark output, but not sure what the problem is.

Internal traffic is not being decrypted.

Any thoughts are appreciated.

Steve

[ecastro]

Hey Steve, 

Did you happen to ever get this resolved? I am experiencing the same issue on 10.1.6.