topic Re: Decrypted traffic via firewall. in General Topics

Decrypted traffic via firewall.

inderjit21 — Tue, 15 Feb 2022 22:17:03 GMT

I don't have any decryption policy configured.
But I see port -443 traffic has decrypted flag yes in Traffic logs.
Is it normal for firewall to decrypt 443 traffic even when there is
no decryption policy?

PANOS0-9.1.10 VM-300

Re: Decrypted traffic via firewall.

BPry — Wed, 16 Feb 2022 00:39:59 GMT

@inderjit21,

This is normal under certain conditions for traffic that terminates at the firewall, for example captive portal or GlobalProtect traffic, even when you don't have decryption enabled.

Re: Decrypted traffic via firewall.

inderjit21 — Wed, 16 Feb 2022 01:55:39 GMT

There is no captive portal configured and is also not GP traffic. trust to untrust 443/web browsing and 443/ssl traffic.

Re: Decrypted traffic via firewall.

aleksandar.astardzhiev — Fri, 18 Feb 2022 21:40:37 GMT

Hey @inderjit21 ,

- Is this traffic being allowed, or blocked?

- Is there related URL logs with action block or continue?

- Any other Threat Log related to that traffic?

I am wondering if this is not related to this - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFKCA0