Network Security
Test Decryption
Table of Contents
Test Decryption
Verify that you are decrypting the traffic you want to decrypt and are not decrypting
sensitive traffic that you don’t want to decrypt.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
No separate license required for decryption when using NGFWs or
Prisma Access.
Note: The features and capabilities available to you in
Strata Cloud Manager depend on your active license(s).
|
After you configure a best practice decryption profile and apply it to traffic, you can check
both the Decryption logs and Traffic logs to verify if the
Next-Generation Firewall (NGFW) is decrypting the traffic that you
intend to decrypt and that it is not decrypting the traffic that you don’t want to
decrypt. This topic shows you how to check decryption using Traffic logs. In
addition, follow post-deployment decryption best
practices to maintain the deployment.
Test Decryption (Strata Cloud Manager)
- Filter the Traffic logs for decrypted traffic sessions.
- Select .
- In the search field, enter the following query: ( Is Proxy = true).
This filter displays only logs in which the SSL proxy flag is on, meaning only decrypted traffic—every log entry has the value true in the Decrypted column.You can filter the traffic more granularly by adding more terms to the query. For example, to filter for decrypted traffic going only to the destination IP address 99.84.224.105, add the query Destination Address = '99.84.224.105'. - Filter the Traffic logs for SSL traffic sessions that were not decrypted.
- Select .
- In the search field, enter one of the following queries:
- (Is Proxy != true) AND (Application = 'SSL')
- (Is Decrypted = False) AND (Application = 'SSL')
This filter displays only logs in which the SSL proxy flag is off (meaning only encrypted traffic) and the traffic is SSL traffic; every log entry has the value false in the Decrypted column and the value ssl in the Application column.Similar to the example for viewing decrypted Traffic logs, you can add terms to filter the traffic that you don’t decrypt in a more granular fashion. - Filter the Traffic logs for a particular session.
- Select .
- Filter on the Session ID using the query Session ID = Session ID value. For example, to see the log for a session with the ID 137020, enter the query: Session ID = 137020). You can find the ID number in the Session ID column in the log output, as shown in the previous screens. If the Session ID column isn’t visible, add the column to the output.
- Filter the Traffic logs for all TLS and SSH traffic.
- Select .
- To view both decrypted and undecrypted TLS and SSH traffic, use the query: Is Encrypted != 0.
- Drill down into the log details.To view more information about a particular log entry, click the log details icon (). For example, for Session ID 137020 (shown in the previous bullet), the detailed log looks like this:
The box for the Decrypted flag provides a second way to verify if traffic was decrypted.You can also take upstream and downstream packet captures of decrypted traffic to view how the NGFW processes SSL traffic and takes actions on packets, or perform deep packet inspection.
Test Decryption (PAN-OS)
- View Decrypted Traffic Sessions—Filter the Traffic Logs () using the filter ( flags has proxy ).This filter displays only logs in which the SSL proxy flag is on, meaning only decrypted traffic—every log entry has the value yes in the Decrypted column.
You can filter the traffic in a more granular fashion by adding more terms to the filter. For example, you can filter for decrypted traffic going only to the destination IP address 99.84.224.105 by adding the filter ( addr.dst in 99.84.224.105 ):
- View SSL Traffic Sessions That Are Not Decrypted—Filter the Traffic Logs () using the filter ( not flags has proxy ) and ( app eq ssl ).This filter displays only logs in which the SSL proxy flag is off (meaning only encrypted traffic) and the traffic is SSL traffic; every log entry has the value no in the Decrypted column and the value ssl in the Application column.
Similar to the example for viewing decrypted traffic logs, you can add terms to filter the traffic that you don’t decrypt in a more granular fashion.
- View The Log for a Particular Session—To view the Traffic log for a particular session, filter on the Session ID.For example, to see the log for a session with the ID 137020, filter using the term ( sessionid eq 137020). You can find the ID number in the Session ID column in the log output, as shown in the previous screens. If the Session ID column isn’t displayed, add the column to the output.
- View All TLS and SSH Traffic—Filter the Traffic Logs () to view both decrypted and undecrypted TLS and SSH traffic, use the filter ( s_encrypted neq 0 ):
- Drill Down Into the Details—To view more information about a particular log entry, click the magnifying glass to see a detailed log view. For example, for Session ID 137020 (shown in the previous bullet), the detailed log looks like this:
The box for the Decrypted flag provides a second way to verify if traffic was decrypted.You can also take upstream and downstream packet captures of decrypted traffic to view how the NGFW processes SSL traffic and takes actions on packets, or perform deep packet inspection.
