Can PA be possible for content inspection after ssh decryption?

[schong]

Hello,

Can PA be possible for content inspection after ssh decryption?

I looked the below document.

Details on Port Forwarding Inside SSH

This document mentioned the following comment.

"Content and threat inspection is not done on the SSH tunnel session"

I don't know that It means whether only 'ssh-tunnel' application or both 'ssh' & "ssh-tunnel' after ssh decryption.

I need your help.

Thanks,

SC Hong

[gbogojevic]

Hi,

The statement means that you cannot identify the actual application that is using the ssh tunnel nor you can scan the content.

PA can identify if the traffic send in the tunnel is pure ssh (e.g. CLI of a device using ssh) and differentiate when an application is using ssh to sneak through the firewall.

As conclusion, you can block applications that use ssh tunnel but you cannot identify which app is actually tunneling within ssh.