topic Security Profiles in General Topics

Security Profiles

Sanjay_Ramaiah — Thu, 12 Oct 2023 05:16:00 GMT

Hi All,

I am bit new to this; may I know if the Security Profiles added in the ACLs works only if we create Decryption rule for that traffic? First it will decrypt the packet then start checking for the AV, URL, File Blocking, VP, Anti-Spyware and WF? Is my understanding, right?

If we do not have Decryption rule in place the above profiles added in the ACL is of now use, is that correct?

Regards,

Sanjay S

Re: Security Profiles

Raido_Rattameister — Thu, 12 Oct 2023 12:20:22 GMT

If you look at Palo packet flow logic you can see that decryption is performed before security profile check.

Additional information https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0

Re: Security Profiles

Sanjay_Ramaiah — Mon, 16 Oct 2023 03:48:32 GMT

Thank you Raido for giving me the answer.

So this clearly says without decrypting the packet it Security Profiles is of no use.

Regards,

Sanjay S

Re: Security Profiles

Raido_Rattameister — Mon, 16 Oct 2023 12:21:06 GMT

It depends.

For example URL categorization still mostly works for SSL traffic using SNI but you can't scan for viruses or other threats without decryption.

Re: Security Profiles

Sanjay_Ramaiah — Fri, 20 Oct 2023 09:03:31 GMT

Thanks again Raido much helpful and much apprciated.