Site / urls you don't want to decrypt

[Alex_Samad]

Hi

I have a set of decrypt rules

1 to no decrypt based on 

src address

or 

dst address

or 

url - the usl is from custom objects / url category where I add in url's lile *.lync.com

then i do my decrypt line so the above gets hit first and then the decrypt

I also notice there is device / cert management / ssl decrypt exclusion << which seems to be a master list of urls to no decrypt.

should I be usine this list or my way above is there an advantage ?  Not sure why I didn't start using the exclusion list from the start

[Remo · Accepted solution]

@Alex_Samad

I like your decryption rules way more than the predefined exclusions. Thats why I disable all of them in most cases (and this has to be done again with every content update - at least for the new ones - which is a little annyoing).

At least since PAN-OS 8 we can control these predefined exclusions, but with the decryption policy I have more control for these exclusions because most of the time (in my case) the exclusion needs to be very specific and not a general one like with the exclusion list because when the exclusion is required from one computer/subnet/zone I don't care if the connection from anywhere else fails (as it is probably blocked in the security policy anyway).

Just my two cents ...