Clarification on Security Policy and Decryption Policy Processing Order

[R.Tabira]

Attention: Global TPM Team
Hello Team,

I am reviewing PAN-OS packet processing behavior related to Security Policy and Decryption Policy evaluation.

Based on the public documentation below, I understand that Security Policy lookup occurs during session setup and that traffic matching a Decryption Policy can be decrypted for further inspection by App-ID and security profiles.

Packet Flow Sequence in PAN-OS

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0

How to Implement and Test SSL Decryption
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEZCA0

However, I could not find documentation explicitly describing the internal processing sequence between Security Policy evaluation and Decryption Policy matching.

Could you please confirm the following?

1. What is the internal processing order when traffic is subject to both Security Policy and Decryption Policy?

2. At which stage is the allow/deny decision made?

3. At which stage is SSL/TLS decryption performed?

4. If traffic is denied by Security Policy, is any decryption processing performed before the session is dropped?

A brief confirmation of the processing sequence is sufficient. No detailed explanation is required.

Thank you for your assistance.