How to exclude IP address or Application from SSL Decrypt

[oscaringosv]

Hello everyone, 

How do you add an expecific application when there is no URLs inside the log?, I.E if you check the traffic logs it's showing SSL as Application and no more info rather than a destination IP that could be changing in the mayority of cases I see the "category" of the App but I don't want to exclude an entire caterory from SSL just a single App or IP Address, also in a different case I need to exclude an especific IP address from SSL decryption how do you achieve this ? thanks a lot in advance. 

[DIRTT · Accepted solution]

You can't exclude "applications" from SSL Inspection as far as I know because the traffic has to be decrypted first so the PaloAlto's can identify the application.  As for whitelisting a domain or IP all you have to do is create a rule above the SSL inspection rule that specifies source and destination (with other stuff) and then select do not decrypt.  That should do the trick just fine unless the IPs are bouncing all over the place.  Then you would need to involve something like MineMeld.

[oscaringosv]

@DIRTTI created a rule base on destination IP and it works perfectly, thanks.