Version Errors

1. Filter the Decryption Log to identify version errors using the filter (err_index eq Version). The highlighted values are bitmask values:
   You can filter the Decryption log in many ways. For example, to see only TLSv1.3 version errors, use the filter (err_index eq Version) and (tls_version eq TLS1.3):

2. Log in to the CLI and look up the bitmask values. The version errors in the first screenshot (the same errors for all three sessions) show an issue with a client and Decryption profile mismatch—the supported client version bitmask is 0x08 and the supported Decryption profile version bitmask is 0x70:

   admin@vm1>debug dataplane show ssl-decrypt bitmask-version 0x08

   TLSv1.0

   This output shows that the client supports only TLSv1.0.

   admin@vm1>debug dataplane show ssl-decrypt bitmask-version 0x70

   TLSv1.1

   TSLv1.2

   TLSv1.3

   This output shows that the Decryption profile supports TLSv1.1, TLSv1.2, and TLSv1.3, but not TLSv1.0. Now you know the issue is that the client only supports a very old version of the TLS protocol and the Decryption profile attached to the decryption policy rule that controls the traffic does not allow TLSv1.0 traffic.
   The next thing to do is decide what action to take. You could update the client so that it accepts a more secure TLS version. If the client requires TLSv1.0 for some reason, you can:
   • Let the firewall continue to block the traffic.
   • Update the Decryption profile to allow all TLSv1.0 traffic (not recommended).
   • Create a decryption policy rule and profile that allow TLSv1.0 and apply it only to the client devices that must use TLSv1.0 and cannot support a more secure protocol (most secure option for allowing the traffic).
   The version error in the second screenshot shows a different issue: a client and server version mismatch. The error indicates the supported client bitmask as 0x20:

   admin@vm1>debug dataplane show ssl-decrypt bitmask-version 0x20

   TLSv1.2

   The output shows that the client supports only TLSv1.2. Since the server does not support TLSv1.2, it may only support TLSv1.3 or it may support only TLSv1.1 or lower (less secure protocols). You can use Wireshark or another packet analysis tool to find out which version of TLS the server supports. Depending on what the server supports, you can:
   • If the server only supports TLSv1.3, you could edit the Decryption profile so that it supports TLSv1.3.
   • If the server only supports TLSv1.1 or lower, evaluate whether you need to access that server for business reasons. If not, consider blocking the traffic to increase security. If you need to access the server for business purposes, create or add the server to a decryption policy rule that applies only to the servers and sites you need to access for business; don’t allow access to all servers that use less secure TLS versions.
3. To find the decryption policy rule that controls the session traffic, check the Policy Name column in the log (or click the magnifying glass icon

   next to the Decryption log to see the information in the General section of the Detailed Log View). In the example above, the decryption policy rule name is Big Brother. To find the decryption policy rule and profile, go to PoliciesDecryption, select the policy named Big Brother, and then select the Options tab. Decryption profile displays the name of the Decryption profile.
   Go to ObjectsDecryptionDecryption Profile, select the appropriate Decryption profile, and edit it to address the version issue.

Cipher Errors

1. Filter the Decryption Log to identify cipher errors using the filter (err_index eq Cipher). For example, let’s examine a cipher error with the Error message Unsupported cipher. Supported client cipher bitmask: 0x80000000. Support decrypt profile cipher bitmask 0x60f79980.
2. Log in to the CLI and look up the bitmask values:

   admin@vm1>debug dataplane show ssl-decrypt bitmask-cipher 0x80000000

   CHACHA_PLY1305_SHA256

   This output shows that client tried to negotiate a cipher that the firewall supports (if the bitmask is all zeros (0x0000000, then the client tried to negotiate a cipher that the firewall doesn’t support):

   admin@vm1>debug dataplane show ssl-decrypt bitmask-cipher 0x80000000

   TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
   TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
   TLS_RSA_WITH_AES_256_CBC_SHA256
   TLS_RSA_WITH_AES_128_CBC_SHA256
   TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
   TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
   TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
   TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
   TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
   TLS_RSA_WITH_AES_256_CBC_SHA
   TLS_RSA_WITH_AES_128_CBC_SHA
   TLS_DHE_RSA_WITH_AES_256_CBC_SHA
   TLS13_WITH_AES_256_GCM_SHA384
   TLS13_WITH_AES_128_GCM_SHA256

   This output shows that the Decryption profile that controls the traffic supports many ciphers, but does not support the cipher the client is trying to use.
   To fix this issue so that the firewall allows and decrypts the traffic, you need to add support for the missing cipher to the Decryption profile.
3. Check the Decryption log or the Detailed Log View Policy Name to get the name of the decryption policy rule that controls the traffic. Go to PoliciesDecryption and select the rule. On the Options tab, look up the name of the Decryption profile. Next, Go to ObjectsDecryptionDecryption Profile, select the appropriate Decryption profile, and edit it to address the version issue.
   In this example, the Decryption profile does not support the TLS13_WITH_CHACHA_POLY1305_SHA256 cipher, so the client can’t connect:
   To fix the issue, select the CHACHA20-POLY1305 encryption algorithm option (the Max Version setting of Max means that the profile already supports TLSv1.3 and the Authentication Algorithm setting already includes SHA256, so only the encryption algorithm support was missing) and then Commit the configuration. After you commit the configuration, the Decryption profile supports the missing cipher and the decryption sessions for the traffic succeed.
   If the firewall does not support a cipher suite and you need to allow the traffic for business purposes, create a decryption policy rule and profile that applies only to that traffic. In the Decryption profile, disable the Block sessions with unsupported cipher suites option.

Root Status “Uninspected”

• Session resumption.
• Traffic was not decrypted because a No Decryption policy rule controlled the traffic.
• A decryption failure occurred before the firewall could inspect the server certificate.