topic Re: Decryption Policy Rule - Profile is None in General Topics

Decryption Policy Rule - Profile is None

jeff6strings — Mon, 19 Jun 2017 15:26:49 GMT

With my new employer I'm managing a 3050 unit with a couple of Decryption Policy Rules which are configured to decrypt using SSL Forward Proxy. The Decryption Profile under Options is set to None. I can't find what the behaviour is when the decryption profile is set to None.

I appreciate any help.

Jeff

Re: Decryption Policy Rule - Profile is None

Remo — Mon, 19 Jun 2017 15:31:35 GMT

Your firewall tries its best. Everything which it is not able to decrypt will be added to a temporary exclude-cache and will pass without being decrypted

Re: Decryption Policy Rule - Profile is None

TranceforLife — Mon, 19 Jun 2017 16:21:26 GMT

I thought that the profile is an additional check for both decrypted&excluded traffic:

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/decryption/create-a-decryption-profile#_12507

Re: Decryption Policy Rule - Profile is None

Remo — Mon, 19 Jun 2017 16:20:19 GMT

@TranceforLife

Yes, you're right. But the profile set to none as mentionned by @jeff6strings it's more a "best effort" thing. (but at least PAN-OS 8.0.x is able to decrypt almost everything)