About aamarin

The port doesn't necessarily have to be 443 or 22 for us to decrypt the traffic. Since the application runs over SSH, we should be able to decrypt it using SSH Proxy.   If the decryption is breaking the application, you can open a ticket with Support for troubleshooting at the link below: https://support.paloaltonetworks.com   I hope that helps. ... View more

Regardless of the port number, we can decrypt SSL and SSH sessions. Since FASP uses SSH for encryption, then technically it should be possible to decrypt it.   Please refer to our Technical Documentation for how SSH Proxy is configured: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/decryption/configure-ssh-proxy.html   ... View more

This is currently a feature request. Only new sessions will be affected by the applied security policy rule. Existing sessions are not affected by the scheduled policy. As a workaround, to enforce the scheduled Security Policy for existing sessions, you can do either of the following: 1. Set a shorter timeout value for the application. 2. Clear the session manually. ... View more

To troubleshoot the issue, you can check if HIP Match is taking place as expected, by checking the HIP match logs.   You can also check the full HIP Report by running the below command from CLI: > debug user-id dump hip-report ip <IP-Address> user <Username> computer <Computer>   To know exactly what to type for the needed fields, you can navigate to "Network > GlobalProtect > Gateways", and then click on "Remote Users", identify the user and fill in according to the below mapping: <IP-Address> --> Private IP <Username> --> Primary Username <Computer> --> Computer   I hope this helps! ... View more