financial-services is exempt from decryption still decrypt error

[MP18]

PA running 8.1.9  we have rule from any source any zone do not decrypt financial-services category.

CLI  test 

test decryption-policy-match source 10.x.x.x  destination 23.249.200.33 category financial-services

Matched rule: 'No_Decrypt' action: no-decrypt

Traffic log shows decrypt error URL log shows no decrypt.

[OtakarKlier]

Hello,

It could be because you are using an IP address instead of the URL. Check the URL against the PAN-DB URl checker.

https://urlfiltering.paloaltonetworks.com/

If its listed correctly there, then the URL should not be decrypted.

Regards,

[MP18]

on traffic log it shows category as unknown and on url filtering logs i see

ipg1.moneris.com/  and category as financial services

[OtakarKlier]

Hello,

If you browse to it from a workstation, does it try to decrypt the traffic?

Regards,

[MP18]

PRoblem is it is ticket vending machine which uses that 

[MP18]

url log shows ipg1.moneris.com/

i can not access this from my pc 

[OtakarKlier · Accepted solution]

Hello,

I have a better understanding now. So what I would do is the following:

Create a security policy that allows that machine to only go to the specific web address.

Create a  decryption policy that allows all traffic sourced from the machine to bypass encryption.

You still know exactly where its going and what its doing.

Just a thought.

[MP18]

I create the decryption security policy to exempt all the traffic to that  destination ip address.

Since then PA is not decrypting.

Also SSL decryption exclusion list i put *.moneris.com and it did not worked.