Network Security
Local SSL Decryption Exclusion Cache
Table of Contents
Local SSL Decryption Exclusion Cache
The NGFW automatically adds SSL decryption exclusions to the local exclusion cache to
allow application traffic that uses unsupported modes.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
No separate license required for decryption when using NGFWs or
Prisma Access.
Note: The features and capabilities available to you in
Strata Cloud Manager depend on your active license(s).
|
The Local SSL Decryption Exclusion Cache contains websites that the
Next-Generation Firewall (NGFW) automatically excludes from decryption
because of technical circumstances that break or prevent decryption, such as pinned
certificates, client authentication, or unsupported ciphers. The NGFW
doesn’t decrypt, inspect, and enforce Security policy rules on traffic that the cache
allows because the traffic remains encrypted. However, traffic in the local cache is
excluded from decryption for 12 hours and then ages out. The NGFW
populates the cache based on the decryption profile associated with the decryption
policy rule that controls the traffic. Specifically, if the decryption profile
allows unsupported modes—sessions with client authentication, unsupported
versions, or unsupported cipher suites—and the allowed traffic uses an unsupported mode,
then the device adds the server to the local exclusion cache. Ensure that the sites you
exclude from decryption (for example, by applying a decryption profile that allows
unsupported modes) are sites with applications or services you need for business.
If you allow unsupported mode checks in a decryption profile, the NGFW
adds entries to the cache when:
- The client or server advertises a specific cipher that the server or client doesn’t support.
- The client or server advertises a specific curve that the server or client doesn’t support.
- The client or server advertises a specific protocol version that the server or client doesn't support.
- Examples: The client supports only TLSv1.2, but the server supports only TLSv1.3. In the local cache, the Reason shown for this exclusion is SSL_UNSUPPORTED.
- The client supports TLSv1.3 and TLSv1.2, but the server supports only TLSv1.2. In this case, the Reason shown is TLS13_UNSUPPORTED.When the Reason for adding a server to the Local SSL Decryption Exclusion Cache is TLS13_UNSUPPORTED, the NGFW downgrades the session protocol to TLSv1.2, so it can decrypt and inspect the traffic.
If the decryption profile blocks unsupported modes, the server is not added
to the local cache and the NGFW blocks traffic to and from the server.
Blocking unsupported modes blocks communication with applications that use those modes
to increase security. Client authentication is a common reason for excluding
applications from decryption, which is why best practice is to block unsupported
versions and unsupported ciphers and allow client authentication in the decryption
profile. If the decryption profile allows client authentication and a client starts a
session with a server that requires the client to authenticate, instead of blocking the
traffic because the NGFW can’t decrypt it, the application and server are
added to the local exclusion cache, which allows the traffic.
If you allow traffic from sites that use client authentication and are not in the
predefined or custom SSL decryption exclusion list, create
a decryption profile that allows sessions with client authentication. Add the
profile to a decryption policy rule that applies only to the servers that host the
application.
To increase security further, require multi-factor authentication to complete the
user login process. Alternatively, you can add the site to the SSL decryption exclusion
list to bypass decryption without using an explicit decryption policy
rule.
The local cache contains a maximum of 1,024 entries. Each exclusion entry includes
information about the application, the server, the reason for inclusion in the cache,
the decryption profile applied to the traffic, its virtual system (vsys), and more. You
can’t manually add local exclusions to the cache, but you can add exclusions to the SSL decryption exclusion list
.
To view the Local SSL Decryption Exclusion Cache, superuser or Certificate Management
administrative access is required.
- (PAN-OS and Panorama) Select , and then click Show Local Exclusion Cache.
You can select and delete entries from the local cache manually. You can also delete
cached entries using the clear ssl-decrypt exclude-cache [server <value>]
[application <value>] CLI command.
If anyone attempts to access the same server before the local cache entry ages out (12
hours), the NGFW matches the session to the cache entry, bypasses
decryption, and allows the traffic. The NGFW flushes the local exclusion
cache if you change the decryption policy rule or profile because those changes might
affect the classification of the session. If the cache becomes full, the oldest entries
are purged as new ones arrive.