topic Re: How to exclude IP address or Application from SSL Decrypt in General Topics

How to exclude IP address or Application from SSL Decrypt

oscaringosv — Fri, 08 Dec 2017 15:08:05 GMT

Hello everyone,

How do you add an expecific application when there is no URLs inside the log?, I.E if you check the traffic logs it's showing SSL as Application and no more info rather than a destination IP that could be changing in the mayority of cases I see the "category" of the App but I don't want to exclude an entire caterory from SSL just a single App or IP Address, also in a different case I need to exclude an especific IP address from SSL decryption how do you achieve this ? thanks a lot in advance.

Re: How to exclude IP address or Application from SSL Decrypt

DIRTT — Fri, 08 Dec 2017 15:26:47 GMT

You can't exclude "applications" from SSL Inspection as far as I know because the traffic has to be decrypted first so the PaloAlto's can identify the application. As for whitelisting a domain or IP all you have to do is create a rule above the SSL inspection rule that specifies source and destination (with other stuff) and then select do not decrypt. That should do the trick just fine unless the IPs are bouncing all over the place. Then you would need to involve something like MineMeld.

Re: How to exclude IP address or Application from SSL Decrypt

oscaringosv — Wed, 13 Dec 2017 17:39:51 GMT

@DIRTTI created a rule base on destination IP and it works perfectly, thanks.