About SteveWright

I would like to test and then gradually deploy Azure MFA SAML authentication. So as not to interfere with the current Portal and Gateway on this firewall I would like to set up a second portal on the same firewall. Can someone tell me if this is possible and what I would need: i.e Do I need another interface with its own public IP or can I use the same interface as the first portal but with a second public IP. Do I need a second loopback and tunnel?  ... View more

I am asking for help to get SSL Inbound decryption working. I have read all the posts and tried everything I can think of but I keep getting the decrypt error status so I may have a basic misunderstanding. If someone has an insight into what I am doing wrong after reading the information below I would be grateful to receive it. The web server is restricted by group policy to a few encryption algorithms that the Palo Alto firewall supports being: • TLS_RSA_WITH_AES_128_CBC_SHA256 • TLS_RSA_WITH_AES_256_CBC_SHA256 • TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c) • TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d)   I have tried a certificate issued by “GoDaddy” and also a certificate issued by my internal CA but I get the same result from each. The clients trust both certificate authorities. When the client connects, one packet appears to be decrypted but the rest produce a Decrypt error. A capture shows no errors. The “Client Hello” appears normal listing its supported encryption algorithms followed by a “Server hello, Change Cipher Spec” which looks like it sets the Encryption algorithm to “TLS_RSA_with_AES_128_CBC_SHA256”. This is followed by a “Change Cipher Spec, Encrypted Handshake Message” which I am unsure what this does. These all appear below. Client Hello   Client hello Server Hello Change Cipher   ... View more