Decryption Policy Rule - Profile is None

[jeff6strings]

With my new employer I'm managing a 3050 unit with a couple of Decryption Policy Rules which are configured to decrypt using SSL Forward Proxy. The Decryption Profile under Options is set to None. I can't find what the behaviour is when the decryption profile is set to None.

I appreciate any help.

Jeff

[vsys_remo · Accepted solution]

Your firewall tries its best. Everything which it is not able to decrypt will be added to a temporary exclude-cache and will pass without being decrypted

[vsys_remo · Accepted solution]

@TranceforLife

Yes, you're right. But the profile set to none as mentionned by @jeff6strings it's more a "best effort" thing. (but at least PAN-OS 8.0.x is able to decrypt almost everything)

[vsys_remo · Accepted solution]

Your firewall tries its best. Everything which it is not able to decrypt will be added to a temporary exclude-cache and will pass without being decrypted

[TranceforLife]

I thought that the profile is an additional check for both decrypted&excluded traffic:

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/decryption/create-a-decryption-profi...

[vsys_remo · Accepted solution]

@TranceforLife

Yes, you're right. But the profile set to none as mentionned by @jeff6strings it's more a "best effort" thing. (but at least PAN-OS 8.0.x is able to decrypt almost everything)