topic Re: Decrypted flag under Monitor Logs in General Topics

Decrypted flag under Monitor Logs

inderjit21 — Tue, 11 Jan 2022 22:55:04 GMT

Is it normal to see Decrypted flag as yes even when there is no decryption policy configured.

So what traffic will PA decrypt even when there is no decrypt policy?

Re: Decrypted flag under Monitor Logs

BPry — Wed, 12 Jan 2022 03:16:55 GMT

GlobalProtect traffic will show decrypted regardless of whether or not you have a decryption policy setup for it. Other than that I can't think of anything off hand that should have that flag without a decryption entry.

Re: Decrypted flag under Monitor Logs

aleksandar.astardzhiev — Wed, 12 Jan 2022 08:13:35 GMT

Hi @inderjit21 ,

In addition to what @BPry mentioned, if you have any URL category with action "Continue" and "Override", basically URL that firewall will send response page. Check this link - How to Serve a URL Response Page Over an HTTPS Session Without SSL Decryption

But in those cases I think firewall will only decrypt initial request, just to be able to inject the HTTP Redirect, after that I assume nothing is actually decrypted.