Clarification on Security Policy and Decryption Policy Processing Order

R.Tabira — Fri, 16 Oct 2026 05:47:55 GMT

Attention: Global TPM Team
Hello Team,

I am reviewing PAN-OS packet processing behavior related to Security Policy and Decryption Policy evaluation.

Based on the public documentation below, I understand that Security Policy lookup occurs during session setup and that traffic matching a Decryption Policy can be decrypted for further inspection by App-ID and security profiles.

Packet Flow Sequence in PAN-OS

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0

How to Implement and Test SSL Decryption
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEZCA0

However, I could not find documentation explicitly describing the internal processing sequence between Security Policy evaluation and Decryption Policy matching.

Could you please confirm the following?

1. What is the internal processing order when traffic is subject to both Security Policy and Decryption Policy?

2. At which stage is the allow/deny decision made?

3. At which stage is SSL/TLS decryption performed?

4. If traffic is denied by Security Policy, is any decryption processing performed before the session is dropped?

A brief confirmation of the processing sequence is sufficient. No detailed explanation is required.

Thank you for your assistance.

Re: Clarification on Security Policy and Decryption Policy Processing Order

reaper — Fri, 16 Oct 2026 10:06:31 GMT

1. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0 shows you the session is marked for inspection once App-ID identifies SSL. for app-id to get to this stage, the session has already passed a security policy check and TCP handshake is established

2. one of multiple steps: stage1 only uses the 6-tuple to determine a security rule allows the tcp handshake. around the 4th packet App-ID could identify ssl so the session is marked for decryption and simultaneously the security rulebase is rechecked to see if the session is still allowed. if not it gets discarded and no decryption happens, if allowed the session is mapped to the (new?) security rule and carted off to decryption

3. see 2.

4. no. security rule deny/drop happens before decryption

security rule actions:

6-tuple (allow/drop)
app-id match (allow/drop)
1. decryption happens here
content match (layer 7 content-ID action)

topic Clarification on Security Policy and Decryption Policy Processing Order in Next-Generation Firewall Discussions

Clarification on Security Policy and Decryption Policy Processing Order

Re: Clarification on Security Policy and Decryption Policy Processing Order