topic Re: Can "Decryption Mirroring" forward non-encryption traffic? in General Topics

Can "Decryption Mirroring" forward non-encryption traffic?

JoeKwok — Thu, 18 Nov 2021 09:54:42 GMT

I am planning to forward all traffic to traffic collection tool.

As I know there are "Decryption Mirroring" (https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption-concepts/decryption-mirroring.html) and it will forward the traffic after decryption.

I would like to know if the traffic is non-encrypted traffic such as http, will it also forward out from the Decrypt Mirror interface?

Re: Can "Decryption Mirroring" forward non-encryption traffic?

LAYER_8 — Thu, 18 Nov 2021 17:05:45 GMT

Decryption broker is not able to forward traffic from policies that aren't hitting a decryption rule.

However, network packet broker (new feature) is able to. See more here.

Re: Can "Decryption Mirroring" forward non-encryption traffic?

JoeKwok — Thu, 18 Nov 2021 17:50:48 GMT

Hi Slick,

Thanks for introduce a new feature.

But it is a broker (need a interface for return traffic), can it used for mirroring (only one output interface) like a SPAN?

Since I am not familiar with decryption policy,

If I set the service of decryption policy as ANY, will http/DNS (non-encrypted traffic) also hit this rule and forward out through Decryption Mirroring interface?

Thank you

Re: Can "Decryption Mirroring" forward non-encryption traffic?

OtakarKlier — Thu, 18 Nov 2021 17:55:35 GMT

Hello,

Unfortunately no. Only traffic that is decrypted gets sent to the mirroring interface. Honestly a tap or span is the best way to capture all traffic.

Regards,

Re: Can "Decryption Mirroring" forward non-encryption traffic?

LAYER_8 — Thu, 18 Nov 2021 18:23:55 GMT

+1 to the above. Decryption mirror will not forward traffic in the manor you are desiring. Packet broker gets a lot closer and satisfies most requirements, but the best way is a downstream/upstream switch mirror the traffic going to the NGFW, in my opinion.