Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
- COVID-19 Response Center
About SteveWright
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About SteveWright
08-19-2020
5Posts
3Likes
0Solutions
Aug 19, 2020Last Visited
User
Activity
User
Profile
Latest posts by SteveWright
| Subject | Views | Posted |
|---|---|---|
| 1896 | 12-26-2017 03:08 PM | |
| 1965 | 08-26-2017 02:49 PM | |
| 1973 | 08-26-2017 04:50 AM | |
| 533 | 07-20-2017 05:29 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 12-26-2017 03:08 PM | |
| 2 Likes | 08-26-2017 02:49 PM |
User Badges
Community Statistics
| Member Since | 07-20-2017 04:22 PM |
| Date Last Visited | 08-19-2020 12:25 AM |
| Posts | 5 |
| Total Likes Received | 3 |
12-26-2017
03:08 PM
1 Kudo
To complete the story: Soon after my post in August I was informed that a flaw in implementing Extended Master Secret would be fixed soon. An update issued soon thereafter fixed the issue.
... View more
08-26-2017
02:49 PM
2 Kudos
I kept researching and found a post by Anil Kumar that indicated the issue may be the TLS Extension " Extended Master Secret ". If I disable this on the server ad the client, decryption works. Disabling this only on the server seems to be insufficient for decryption to work. The problem now is what to do. Do I downgrade from TLS to SSL or do I forgo decryption. I would be interested in your comment on these options. Does anyone know if/when Palo Alto will support this Extension for decryption?
... View more
08-26-2017
04:50 AM
I am asking for help to get SSL Inbound decryption working. I have read all the posts and tried everything I can think of but I keep getting the decrypt error status so I may have a basic misunderstanding. If someone has an insight into what I am doing wrong after reading the information below I would be grateful to receive it. The web server is restricted by group policy to a few encryption algorithms that the Palo Alto firewall supports being: • TLS_RSA_WITH_AES_128_CBC_SHA256 • TLS_RSA_WITH_AES_256_CBC_SHA256 • TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c) • TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d) I have tried a certificate issued by “GoDaddy” and also a certificate issued by my internal CA but I get the same result from each. The clients trust both certificate authorities. When the client connects, one packet appears to be decrypted but the rest produce a Decrypt error. A capture shows no errors. The “Client Hello” appears normal listing its supported encryption algorithms followed by a “Server hello, Change Cipher Spec” which looks like it sets the Encryption algorithm to “TLS_RSA_with_AES_128_CBC_SHA256”. This is followed by a “Change Cipher Spec, Encrypted Handshake Message” which I am unsure what this does. These all appear below. Client Hello Client hello Server Hello Change Cipher
... View more
07-20-2017
05:29 PM
It has been 5 years since this discussion and I was wondering if there had been any changes that may effect what was available then: i.e. can the Palo Alto be a proxy target now. To prevent the flood of responses telling me that I need a proxy that caches let me paint the picture. I would like to use the Palo Alto as a backup Internet Access point for the WAN. I do not want to reconfigure all the routers on the WAN to point o the Palo Alto if the primary Internet Access point goes down but I could easily change a proxy.pac script to point them to an alternate access point being the firewall. I would rather not use a cacheing proxy server (eg Squid) as it seems to interfere with SSL decrypt and I still want this protection. (unless someone can tell me how to overcome the squid proxy preventing SSL decrypt on the Palo Alto).
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-19-2020
12:25 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2021 - Palo Alto Networks
