PKI Authentication for SSH Stopped Working after SSH Decryption was Enabled

Symptoms

After enabling SSH decryption, authenticating to hosts with a certificate no longer works. Authentication still works with a manual password.

Issue

Once you enable ssh decryption on the firewall the ssh client no longer uses the public key used to gain access to devices. The ssh client can still login to the devices with user name and password but public key authentication (passwordless) fails.

Workaround

Configure your ssh decryption policy to exclude the systems that require public key authentication.

Edit the ssh decrytion policy, go into the the destination tab and add the IP addresses to be excluded into the 'Destination Address' tab then check the Negate box.

owner: jteetsel