cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Who Me Too'd this topic

Decryption: Client and decrypt profile version mismatch

L2 Linker

Hi folks,

 

Have been seeing a lot of "'Client and decrypt profile version mismatch. Supported client version bitmask: 0x08. Supported decrypt profile version bitmask: 0x60. ' errors in the log lately. This article:

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/troubleshoot-and-monitor-decry...

indicates that the client is trying TLS 1.0, whereas the decryption profile only supports > TLS 1.2. I don't see how this could be since the clients generating these are all fully updated Win10, which should use TLS 1.2 by default. I've checked in the 'Internet Options' control panel item on these clients and TLS 1.2 is in fact selected. I've tried to get packet captures, but these happen at random times to random IP adresses, so it has been difficult. My only thought is that some application is attempting to force a connection using TLS 1.0? Any other thoughts on what it could be?

Thanks!

Who Me Too'd this topic