topic Re: SSL decryption issue on Palo Alto firewall in General Topics

SSL decryption issue on Palo Alto firewall

karansin_amd — Tue, 16 Jan 2024 14:03:51 GMT

Re: SSL decryption issue on Palo Alto firewall

karansin_amd — Tue, 16 Jan 2024 14:06:57 GMT

We have SSL decryption running on our PAN for selective URL categories however we noticed that at times PAN logs decrypt action for categories not included in decrypt rule. Any idea why this may be happening ? This is not always but we see many traffic/URL filtering logs that has proxy flag set to "yes" for categories we do not decrypt per decrypt rule.

Re: SSL decryption issue on Palo Alto firewall

Raido_Rattameister — Wed, 17 Jan 2024 19:04:55 GMT

Some URLs are in multiple categories.

For example dns.google is in in Computer-and-Internet-Info and Encrypted-DNS categories.

Check "URL Category List" value for the URL.

Re: SSL decryption issue on Palo Alto firewall

karansin_amd — Thu, 18 Jan 2024 05:51:03 GMT

I did check and the URL is part of categories which are not part of decrypt rule. I suspect it is issue with proxy engine on PAN platform