topic Re: SSL Forward Proxy - Exclude certain IPs from decryption in VM-Series in the Public Cloud

SSL Forward Proxy - Exclude certain IPs from decryption

j.rowe — Fri, 14 Feb 2025 11:53:27 GMT

Hi there,

I'm running PA-VM (VM-300) version 9.1.16-h3 in Azure. I have configured response pages which work as expected. However, I cannot seem to stop decryption of SSL traffic for specific source IPs

Out of frustration I have configured an any/any do not decrypt run and I can still cleary see SSL traffic being decrypted rather than just the connection being terminated.

Is this by design or am I missing something ?

Re: SSL Forward Proxy - Exclude certain IPs from decryption

Raido_Rattameister — Fri, 14 Feb 2025 14:00:12 GMT

In "Options" tab of "Decryption Policy Rule" you have Action setting set to "No Decrypt" and Type "SSL Forward Proxy"?

Re: SSL Forward Proxy - Exclude certain IPs from decryption

j.rowe — Fri, 14 Feb 2025 14:26:47 GMT

This is how I have it configured

Re: SSL Forward Proxy - Exclude certain IPs from decryption

Raido_Rattameister — Fri, 14 Feb 2025 16:14:14 GMT

Config is committed successfully right?