For those that seek to get SSH Proxy working

[Han.Valk]

Searching the internet it seems that people are looking to enable SSH Proxy and not finding answers. I managed to get it working but must say that the current supported SSH decrytion parameters for all PAN-OS versions aren't the most secure ones so you should consider what's more important for your situation:

• SSH inspection with less secure SSH configuration.
• No SSH inspection with robust SSH parameters.

Environment:

• PAN-OS 11.1.X
• OpenSSH 9.X
• Bitvise SSH Client 9.X

sshd_config on a Linux box so that SSH decryption will be possible:

• Ciphers aes256-ctr,aes192-ctr,aes128-ctr
• MACs hmac-sha1
• HostKeyAlgorithms ssh-rsa
• KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1
• RequiredRSASize 2048

I use the free Windows Bitvise client because it allows to customize the SSH parameters.

Decryption profile:

Decryption policy:

Result:

Regards,

Han.

[JayGolf]

@Han.Valk ,

Thank you for sharing!