topic deafult decryption in Automation/API Discussions

deafult decryption

per_markgren — Tue, 18 Mar 2014 09:15:03 GMT

Hi,

I run a HA-cluster of PA-5020 PAN OS 5.0.10

I've just noticed that since I've upgraded from 5.0.8 to 5.0.10 a specific traffic was identified as web-browsing instead of as before SSL.

It seems that traffic identified as web-browsing over port TCP 443 always is decrypted. Is this so? The only way I've managed to control this is by a Application Override rule to identify the taffic as a other app then web-browsing.

How can I control what is being decrypted and not other than by my decryption rules?

BR // Per

Re: deafult decryption

mr.linus — Wed, 26 Mar 2014 16:17:37 GMT

Dear per.markgren,

The PaloAlto will only decrypt traffic based on the decryption policies. web-browsing is not decrypted by default, this can only be because you have a decryption policy in place.

If you do not want to decrypt certain traffic just create a rule for it under the decryption policies

ex: source: xxx / destination: any / service: http / action = NO-DECRYPT

Put that rule at the top, and this traffic will no longer be decrypted.

Re: deafult decryption

kdd — Wed, 26 Mar 2014 16:34:43 GMT

Hi Per,

to control what is being decryped take look on a log-entry which you want to check

when decrypted is checked you can be shure

Regards Klaus