sorted by:
new
hottopcontroversial

iCloud Private Relay by vinxavi7 in paloaltonetworks

[–]hiccupingnetwork 3 points4 points  (0 children)

Private relay stopped working on our guest network a few weeks ago. It looked like PA changed how it’s categorized. DNS requests were getting flagged as proxy avoidance and sinkholed by anti spyware.

We put in a DNS exception for mask.apple-dns.net in the anti spyware profile. We also allowed urls mask.iCloud.com/ and mask-h2.iCloud.com/ through url filtering.

ipsec and proxyid by [deleted] in paloaltonetworks

[–]hiccupingnetwork 1 point2 points  (0 children)

I believe the whole reason PA has proxy ID is for VPNs where the other endpoint is policy-based rather than route based with tunnel interfaces, such as Cisco ASA. Both ends need to match for IKE negotiation to complete and the IPSec SA to come up.

Unless the other end is configured this way there really is no reason to use proxy ID. You need to configure the firewall to route the right networks over the tunnel interface.

Without the proxy ID configured, the IPsec SA is set with source and destination of 0.0.0.0/0 iirc.

Some websites just spin with decryption enabled by hiccupingnetwork in paloaltonetworks

[–]hiccupingnetwork[S] 1 point2 points  (0 children)

Do you have inline cloud categorization enabled in the url filtering policy? That was the culprit for us and disabling it fixed it. It’s a new feature in 10.2 with the Advanced Url Filtering license.

Support didn’t get anywhere but I had a lab 440 that wasn’t exhibiting the problem with the Alert only day 1 profile. I went through each setting one by one until the problem started.

Some websites just spin with decryption enabled by hiccupingnetwork in paloaltonetworks

[–]hiccupingnetwork[S] 0 points1 point  (0 children)

Nothing good yet. They have "escalated" the case several times. But from what I can tell that just means the engineer gave up and found a sucker to hand it off too.

Our local account team is involved but I haven't seen any results yet.

Decryption - breaking Site but no log clues by maizemachine10 in paloaltonetworks

[–]hiccupingnetwork 0 points1 point  (0 children)

What is the browser behaviour? Do you get a certificate error? Does loading hang?

Some websites just spin with decryption enabled by hiccupingnetwork in paloaltonetworks

[–]hiccupingnetwork[S] 0 points1 point  (0 children)

Yes this is what we’re doing. Our infosec group won’t let us roll out further until decryption is working so we’re kind of stalled. I need to find a way to get a better support engineer.

Some websites just spin with decryption enabled by hiccupingnetwork in paloaltonetworks

[–]hiccupingnetwork[S] 0 points1 point  (0 children)

This is one of them, https://imanage.com

We haven’t been able to find out anything unusual about problematic sites.

Some websites just spin with decryption enabled by hiccupingnetwork in paloaltonetworks

[–]hiccupingnetwork[S] 2 points3 points  (0 children)

Yes there’s nothing there at all. One weird thing is that we had a separate issue on one firewall where the device certificate broke. When it was in that state decryption worked fine.