Decrypted traffic via firewall.

[inderjit21]

I don't have any decryption policy configured.
But I see port -443 traffic has decrypted flag yes in Traffic logs.
Is it normal for firewall to decrypt 443 traffic even when there is
no decryption policy?

PANOS0-9.1.10 VM-300

[BPry]

@inderjit21,

This is normal under certain conditions for traffic that terminates at the firewall, for example captive portal or GlobalProtect traffic, even when you don't have decryption enabled. 

[inderjit21]

There is no captive portal configured and is also not GP traffic. trust to untrust 443/web browsing  and 443/ssl traffic.

[aleksandar.astardzhiev]

Hey @inderjit21 ,

- Is this traffic being allowed, or blocked?

- Is there related URL logs with action block or continue?

- Any other Threat Log related to that traffic?

I am wondering if this is not related to this - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFKCA0