topic Re: show session all filter application ssl tunnel-decap no in General Topics

show session all filter application ssl tunnel-decap no

MP18 — Thu, 01 Nov 2018 19:29:51 GMT

need to know when i run below command

show session all filter application ssl tunnel-decap no

it shows lot of output and app is ssl

which traffic is this?

is this traffic where ssl decryption is going on?

Re: show session all filter application ssl tunnel-decap no

JW6224 — Fri, 02 Nov 2018 12:55:49 GMT

admin> find command keyword tunnel-decap
show session all start-at <1-2097152> filter nat <none|source|destination|both> ssl-decrypt <yes|no> tunnel-inspected <yes|no> tunnel-decap <yes|no> decrypt-mirror <yes|no> count <yes|no> type <flow|predict> state <initial|opening|active|discard|closing|closed> from <value> to <value> source <ip/netmask> destination <ip/netmask> source-user <value> destination-user <value> source-port <1-65535> destination-port <1-65535> protocol <1-255> application <value> rule <value> nat-rule <value> qos-rule <value> pbf-rule <value> hw-interface <value> ingress-interface <value> egress-interface <value> min-kb <1-1048576> qos-node-id <0-5000>|<-2> qos-class <1-8> vsys-name <value>|<any> rematch <security-policy>

admin> show session all filter application ssl tunnel-

+ tunnel-decap session is outer tunnel with inspection enabled
+ tunnel-inspected session is inside tunnel

"show session all" is a command that, it will not surprise you to learn, shows all your currently active sessions. The filter the "tunnel-decap" option specifies whether you want to look at sessions that have been decapsulated from a tunnel, such as a GRE or L2TP tunnel. In your command, your "tunnel-decap no" specifies you're interested in sessions that are not decapsulated from a tunnel. If you aren't doing any tunneling, my guess is that output would look identical to if you didn't have it at all.

Re: show session all filter application ssl tunnel-decap no

MP18 — Fri, 02 Nov 2018 15:05:40 GMT

we are not using any tunnel gre or l2.

I did not get you what u mean?

Re: show session all filter application ssl tunnel-decap no

Raido_Rattameister — Fri, 02 Nov 2018 15:47:21 GMT

If there are no tunnels then your command in initial post shows exactly correct.

show session all filter application ssl tunnel-decap no

If you change it to "yes" then you should have no sessions in output.

show session all filter application ssl tunnel-decap yes