topic Re: SSL Decryption Question PANOS9 in General Topics

SSL Decryption Question PANOS9

HW-ChrisME — Wed, 24 Mar 2021 13:42:03 GMT

Hi,

i have one short question about PANOS 9 and 10 ssl decryption.

We use ssl decryption on all PAs for many years.

Is the rule 77 obsolet after upgrade to PANOS 9 /10??

The rule was a must have for ssl decryption working on PANOS 7.

Best regards,

Chris

Re: SSL Decryption Question PANOS9

VincentPresogna — Wed, 24 Mar 2021 16:03:44 GMT

What I would probably do is, reset the hit counters for that rule, and then see if it gets any hits. If it doesn't get any hits over a few days, then it should be safe to disable it.

Re: SSL Decryption Question PANOS9

OtakarKlier — Wed, 24 Mar 2021 19:58:46 GMT

Hello,

Its valid from what I can tell. However with the new builds, you dont have to put in the 'service' portion since the PAN is smart enough now to know that it will have web-browsing over 443 if its decrypted but no worries to keep the services there.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClgHCAS

Regards,

Re: SSL Decryption Question PANOS9

HW-ChrisME — Wed, 24 Mar 2021 19:59:11 GMT

Zero policy hits the whole day!

I think the https policy for ssl decryption is obsolet. 🙂

Hitcounter and policy optimzer are very nice new features.