topic Re: how can I know that traffic is hitting a configured decryption policy ? in General Topics

how can I know that traffic is hitting a configured decryption policy ?

AKamal — Tue, 28 May 2013 12:32:58 GMT

SSL decryption Policy question, how can I know that traffic is hitting a configured decryption policy ?

There's nothing in the Monitor Tab for decryption policies, nor can I get anything out of the CLI command "show log traffic rule equal DECRYPTION-RULE-NAME" ,

any ideas ?

Re: how can I know that traffic is hitting a configured decryption policy ?

Retired Member — Tue, 28 May 2013 12:41:06 GMT

Do you have many decryption rules ?

if traffic hits a rule and is decrypted you can see it from monitor/traffic log inside magnifier

Re: how can I know that traffic is hitting a configured decryption policy ?

VinceM — Tue, 28 May 2013 12:58:23 GMT

HI,

First match your decrytion policies, second, on a traffic log, you can click on small icon on the left and check if your session have been decrypted

Rgds

Re: how can I know that traffic is hitting a configured decryption policy ?

sraghunandan — Tue, 28 May 2013 18:22:40 GMT

This cli command would help too

> show session all filter ssl-decrypt yes (under flag if you see an asterix that means the session is getting decrypted)

Re: how can I know that traffic is hitting a configured decryption policy ?

AKamal — Wed, 29 May 2013 10:11:50 GMT

Thank you everyone for investing your time and effort in replying to my question
And thank you sraghunandan for the tip on the cli command

Re: how can I know that traffic is hitting a configured decryption policy ?

gmurugan — Tue, 06 Sep 2022 17:08:11 GMT

That is fine but how do you find which decryption policy it is hitting?

Re: how can I know that traffic is hitting a configured decryption policy ?

OtakarKlier — Tue, 06 Sep 2022 19:09:18 GMT

Hello,

There are a lot of hidden Columns in the logs. To add them into the view, click one of the column headers and then hover your mouse over the Columns chevron and the display options appear.

The ones you will want to have checked are the following:

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/troubleshoot-and-monitor-decryption

Hope that helps.

Re: how can I know that traffic is hitting a configured decryption policy ?

Adrian_Jensen — Tue, 06 Sep 2022 21:03:54 GMT

"Decryption Rule" must be a 10.x specific column as that does not show up in 9.x. However, you can test which decryption rule would apply to a given source/destination by using the 'Test Policy Match" tool at the bottom of the Decryption Policy page.

Re: how can I know that traffic is hitting a configured decryption policy ?

gmurugan — Tue, 06 Sep 2022 21:07:53 GMT

Hey, Adrian Thank you for the help.

Re: how can I know that traffic is hitting a configured decryption policy ?

gmurugan — Tue, 06 Sep 2022 21:08:38 GMT

Thank you, Otakar.