Clarification on Security Policy and Decryption Policy Processing Order

[Nimbus]

Attention: Global TPM Team
Hello Team,

I am reviewing PAN-OS packet processing behavior related to Security Policy and Decryption Policy evaluation.

Based on the public documentation below, I understand that Security Policy lookup occurs during session setup and that traffic matching a Decryption Policy can be decrypted for further inspection by App-ID and security profiles.

Packet Flow Sequence in PAN-OS

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0

How to Implement and Test SSL Decryption
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEZCA0

However, I could not find documentation explicitly describing the internal processing sequence between Security Policy evaluation and Decryption Policy matching.

Could you please confirm the following?

1. What is the internal processing order when traffic is subject to both Security Policy and Decryption Policy?

2. At which stage is the allow/deny decision made?

3. At which stage is SSL/TLS decryption performed?

4. If traffic is denied by Security Policy, is any decryption processing performed before the session is dropped?

A brief confirmation of the processing sequence is sufficient. No detailed explanation is required.

Thank you for your assistance.

[reaper]

1.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0 shows you the session is marked for inspection once App-ID identifies SSL. for app-id to get to this stage, the session has already passed a security policy check and TCP handshake is established

2. one of multiple steps: stage1 only uses the 6-tuple to determine a security rule allows the tcp handshake. around the 4th packet App-ID could identify ssl so the session is marked for decryption and simultaneously the security rulebase is rechecked to see if the session is still allowed. if not it gets discarded and no decryption happens, if allowed the session is mapped to the (new?) security rule and carted off to decryption

3. see 2.

4. no. security rule deny/drop happens before decryption

security rule actions:

1. 6-tuple (allow/drop)
2. app-id match (allow/drop)
   1. decryption happens here
3. content match (layer 7 content-ID action)

[mcanaval]

Hola, Nimbo.

1. Primero, el firewall evalúa la política de seguridad y posteriormente la política de descifrado (Decryption Policy).

2. En la primera etapa, Palo Alto identifica la política de seguridad que corresponde al tráfico que está atravesando el firewall.

3. En la segunda etapa, una vez que el firewall determina que el tráfico está permitido por la política de seguridad, inicia el proceso de descifrado, siempre que exista una política de Decryption que aplique.

4. Si la política de seguridad deniega el tráfico, el firewall no continúa con el proceso de descifrado.

Espero haberte ayudado a resolver tus dudas. No dudes en comentarme si tienes alguna consulta adicional.

Saludos.

Marco Canaval

CEO de Argos Networks