Decrypted flag under Monitor Logs

[inderjit21]

Is it normal to see Decrypted flag as yes even when there is no decryption policy configured.

So what traffic will PA decrypt even when there is no decrypt policy?

[BPry]

@inderjit21,

GlobalProtect traffic will show decrypted regardless of whether or not you have a decryption policy setup for it. Other than that I can't think of anything off hand that should have that flag without a decryption entry. 

[aleksandar.astardzhiev]

Hi @inderjit21 ,

In addition to what @BPry  mentioned,  if you have any URL category with action "Continue" and "Override", basically URL that firewall will send response page. Check this link - How to Serve a URL Response Page Over an HTTPS Session Without SSL Decryption 

But in those cases I think firewall will only decrypt initial request, just to be able to inject the HTTP Redirect, after that I assume nothing is actually decrypted.