Action and Session End Reason conflict when SSL decryption enabled

[nikoo]

Hi,

SSL decryption was turned on for one of the inside servers. Although it looks good, but some of the logs are rather strange.

There are sessions like these:

Basically  Action - Allow, Rule is hitting correct one (the one permitting the traffic), but Type is Deny and Session End Reason is policy-deny. That looks false to me and it seems that traffic is permitted indeed. Can check more with captures, etc., but has anyone seen such an effect?

 PAN-OS: 8.0.2

[ACortes]

In my case, that kind of log appears at least when the browser shows the typical message about untrusted certificate. Is this your case?

[nevolex]

is there any eta when it will be fixed, as this conflicts with my dynamic no-ssl-decrypt groups, the policy works and the traffic is marked and supposed to be bypassed for decryption but it hits the allow policy but "end reason - policy deny"