01-25-2012 03:42 AM
I know in order to look inside the SSH traffic to see if someone is doing SSH Tunnels you need to decrypt the SSH session.
I am looking to find out how the PAN decrypts the SSH traffic and what is all involved in setting this up on the firewall.
01-25-2012 05:35 AM
Basicaly you have to configure a Decryption Policy under Policies>Decryption. I'd start by reading the PAN help, search ssh-tunnel, and the Tech Note “Controlling SSL Decryption,” for instructions on managing SSL certificates to avoid certificate mismatch errors, and “Controlling SSL Decryption” might be a good start as well.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
