SSL Forward Proxy Not Working

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

SSL Forward Proxy Not Working

L3 Networker

Hello all, another problem on my road to learning! I have created a self-signed CA Cert on my Palo Alto firewall. Exported to my Windows 10 box, imported into root CA store etc. I have set the cert as a Forward Trust Certificate, created a decryption policy and even added a custom SSL-Decrypt profile/policy. The action is decrypt. I can browse facebook.com but the cert is still signed by DigiCert Inc and not my firewall. Any thoughts? I have a security policy which allows all traffic to Web as I can get to FB etc. Thanks,

 

Geoff

1 accepted solution

Accepted Solutions

Hi @GWynn ,

In general SSL decryption does not require separate subcription license. Howerver I had experiance when working with old PA-3020, where support license had expired and any traffic sent to Content-ID process for inspection was dropped with reason "resource-unavailable".

 

Your decryption rules find on first look, so it is hard to think your traffic is not matching it.

Have you look at some of these commands - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClF2CAK

 

You may also try to check the global counters for session that should be decrypted but it is not:

1. Set a filter with source IP and destination port 443 - to capture any HTTPS traffic from your test machine

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloNCAS

2. Before opening the page run the show counter command with delta to reset the counters:

> show counter global filter packet-filter yes delta yes

3. Open HTTPS page and reproduce the issue with page not being decrypted

4. Run show counters with delta gain and examine the output

> show counter global filter packet-filter yes delta yes

 

What is the output from the last show counters?

View solution in original post

7 REPLIES 7

Hi @GWynn,

Can you share your decryption rule? How it is configured?

Have you checked if the page you are testing is not listed in Device -> SSL Decryption Exclusions Palo Alto Networks Predefined Decryption Exclusions

GWynn_0-1699997145015.png

GWynn_1-1699997161665.png

GWynn_2-1699997172589.pngGWynn_3-1699997185728.png

GWynn_4-1699997203164.png

Morning @aleksandar.astardzhiev Facebook is not on that list but very interesting, thank- you! I am also using generic sites such as www.fast.com.

Here is my policy, thanks!

 

 

 

 

Hi @GWynn ,

Is this virtual FW or physical?

Is it lab FW without active licenses?

Hello, it is a virtual lab running on VMWorkstation I have active license for a week or so left!

Do you need a license for Forward Proxy etc? Looks like the answer is no, I researched then same back to this question!

Hi @GWynn ,

In general SSL decryption does not require separate subcription license. Howerver I had experiance when working with old PA-3020, where support license had expired and any traffic sent to Content-ID process for inspection was dropped with reason "resource-unavailable".

 

Your decryption rules find on first look, so it is hard to think your traffic is not matching it.

Have you look at some of these commands - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClF2CAK

 

You may also try to check the global counters for session that should be decrypted but it is not:

1. Set a filter with source IP and destination port 443 - to capture any HTTPS traffic from your test machine

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloNCAS

2. Before opening the page run the show counter command with delta to reset the counters:

> show counter global filter packet-filter yes delta yes

3. Open HTTPS page and reproduce the issue with page not being decrypted

4. Run show counters with delta gain and examine the output

> show counter global filter packet-filter yes delta yes

 

What is the output from the last show counters?

Hello @aleksandar.astardzhiev Sorry for late reply. I have figured this out! Super easy and a tad embarrassing! The security rules were not setup properly so it simply was not been checked! Once I put the lan users in the lan zone, viola! it worked as expected. Thanks so much for your help I really appreciate it and those command are great too for future reference.

Regards - Geoff

  • 1 accepted solution
  • 979 Views
  • 7 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!