Can "Decryption Mirroring" forward non-encryption traffic?

[JoeKwok]

I am planning to forward all traffic to traffic collection tool.

As I know there are "Decryption Mirroring" (https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption-concepts/decryption...) and it will forward the traffic after decryption.

I would like to know if the traffic is non-encrypted traffic such as http, will it also forward out from the Decrypt Mirror interface?

[LAYER_8 · Accepted solution]

Decryption broker is not able to forward traffic from policies that aren't hitting a decryption rule. 

However, network packet broker (new feature) is able to. See more here.

[JoeKwok]

Hi Slick,

Thanks for introduce a new feature.

But it is a broker (need a interface for return traffic), can it used for mirroring (only one output interface) like a SPAN?

Since I am not familiar with decryption policy,

If I set the service of decryption policy as ANY, will http/DNS (non-encrypted traffic) also hit this rule and forward out through Decryption Mirroring interface?

Thank you

[OtakarKlier]

Hello,

Unfortunately no. Only traffic that is decrypted gets sent to the mirroring interface. Honestly a tap or span is the best way to capture all traffic.

Regards,

[LAYER_8]

+1 to the above. Decryption mirror will not forward traffic in the manor you are desiring. Packet broker gets a lot closer and satisfies most requirements, but the best way is a downstream/upstream switch mirror the traffic going to the NGFW, in my opinion.