topic Re: Should Advanced Threat Prevention ( Inline ML ) and Wildfire Analysis be enabled if we dont have a decryption policy enabled ? in Next-Generation Firewall Discussions

Should Advanced Threat Prevention ( Inline ML ) and Wildfire Analysis be enabled if we dont have a decryption policy enabled ?

Kandarp_Desai — Sat, 28 Jan 2023 10:56:03 GMT

Hello,

As per the question, should we enable these features if we don't use SSL decryption. And also, we want to enable it on our Firewalls as well as our Prisma Access rules.

Re: Should Advanced Threat Prevention ( Inline ML ) and Wildfire Analysis be enabled if we dont have a decryption policy enabled ?

TomYoung — Sat, 28 Jan 2023 18:32:34 GMT

Hi @Kandarp_Desai ,

This is a pic I took from Ignite this year.

It is a great slide to show you what you cannot do without encryption. Since 90% of web traffic is encrypted, it is strongly encouraged that you enable it. PANW makes it a lot easier than others.

If you enable Threat and WildFire without decryption, it will still work on unencrypted traffic, and some features will partially work on encrypted traffic. So, yes, its protection is greatly reduced.

Thanks,

Tom

Re: Should Advanced Threat Prevention ( Inline ML ) and Wildfire Analysis be enabled if we dont have a decryption policy enabled ?

Kandarp_Desai — Mon, 30 Jan 2023 07:31:26 GMT

Thanks for your reply @TomYoung