Security Profiles

[Sanjay_Ramaiah]

Hi All,

I am bit new to this; may I know if the Security Profiles added in the ACLs works only if we create Decryption rule for that traffic? First it will decrypt the packet then start checking for the AV, URL, File Blocking, VP, Anti-Spyware and WF? Is my understanding, right?

If we do not have Decryption rule in place the above profiles added in the ACL is of now use, is that correct?

Regards,

Sanjay S

[Raido_Rattameister · Accepted solution]

If you look at Palo packet flow logic you can see that decryption is performed before security profile check.

Additional information https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0

[Sanjay_Ramaiah]

Thank you Raido for giving me the answer.

So this clearly says without decrypting the packet it Security Profiles is of no use.

Regards,

Sanjay S

[Raido_Rattameister]

It depends.

For example URL categorization still mostly works for SSL traffic using SNI but you can't scan for viruses or other threats without decryption.

[Sanjay_Ramaiah]

Thanks again Raido much helpful and much apprciated.