Site / urls you don't want to decrypt

Alex_Samad — Fri, 14 Sep 2018 01:22:02 GMT

I have a set of decrypt rules

1 to no decrypt based on

src address

dst address

url - the usl is from custom objects / url category where I add in url's lile *.lync.com

then i do my decrypt line so the above gets hit first and then the decrypt

I also notice there is device / cert management / ssl decrypt exclusion << which seems to be a master list of urls to no decrypt.

should I be usine this list or my way above is there an advantage ? Not sure why I didn't start using the exclusion list from the start

Re: Site / urls you don't want to decrypt

Remo — Fri, 14 Sep 2018 08:03:25 GMT

@Alex_Samad

I like your decryption rules way more than the predefined exclusions. Thats why I disable all of them in most cases (and this has to be done again with every content update - at least for the new ones - which is a little annyoing).

At least since PAN-OS 8 we can control these predefined exclusions, but with the decryption policy I have more control for these exclusions because most of the time (in my case) the exclusion needs to be very specific and not a general one like with the exclusion list because when the exclusion is required from one computer/subnet/zone I don't care if the connection from anywhere else fails (as it is probably blocked in the security policy anyway).

Just my two cents ...

topic Re: Site / urls you don't want to decrypt in General Topics

Site / urls you don't want to decrypt

Re: Site / urls you don't want to decrypt