SSL Decryption, ¿hardware or software?

[ssancho]

Hi, anybody knows if PA3020 and PA3050 has a dedicated hardware for SSL Decryption?. I saw a document a few years ago where you can see that some Palo Altos has a dedicated chip for SSL decryption but I could not find it again and I do not see if PA3020 and PA3050 has the hardware or not.

Many thanks for your help

Best regards

Samuel

[Hithead]

Hi did you mean this? :

Simplify SSL certificate signing and management process.

You can utilize dedicated hardware security modules (HSM) to manage the certificate signing functions for SSL forward proxy, SSL inbound inspection, and the master key storage functions. HSM support is generally required when FIPS 140-2 Level 3 protection for CA keys is required.
 

• Supported HSMs: SafeNet Luna SA and Thales Nshield Connect.

• Platforms supported: PA-7050, PA-5000 Series, PA-4000 Series, PA-3000 Series, VM-Series and the M-100 management appliance.

https://www.paloaltonetworks.com/products/features/decryption.html

[ssancho]

Hi, not exactly. What I mean is that, when you configured a  SSL decryptcion policy, is there any hardware chip insdie the PA-3020 or PA3050 that do the job to decrypt the traffic?, or all decryption is done by software?.

If you only wants to decrypt some traffic (and not all), as I understand, it is not necesary to install a decryption device because the firewall can decrypt the traffic directly.

Many thanks for your reply

Best regards

Samuel

[Hithead]

ssl decryption happens in the dataplane, a dedicated hardware (as i know). at all hardware series, except the PA-200, the traffic operation part (ssl, policy, threat scan...) is separated between the dataplane and management plane (MGT, reports, logging..)