Exclude Traffic from Decryption for Business, Legal, or Regulatory Reasons (Strata Cloud Manager)

1. Create a decryption policy rule or modify an existing rule.

   Fill out basic information and all required fields under the Source, Destination, and Log Settings sections. For source and destination Zones, select Any Zones, so that the no-decrypt rule applies to all SSL traffic destined for an external server.
2. Define match criteria for the traffic you want to exclude from decryption.

   1. In the Services and URLs section, click Add URL Categories.
   2. Select from predefined URL categories or Create New custom URL categories. The NGFW excludes traffic to selected categories from decryption unless you create an exception rule.

      You can also Add External Dynamic Lists or Add SaaS Application Endpoints.
3. Specify that you don't want to decrypt traffic matching the rule.

   In the Action and Advanced Inspection section, for Action, select Do Not Decrypt.
4. (Best Practice) Apply a decryption profile that blocks sessions with expired certificates and untrusted issuers.

   1. Configure or modify a no-decryption profile if you haven't already.

      1. Select the No Decryption tab.
      2. For Server Certificate Verification, select Block sessions with expired certificate and Block sessions with untrusted issuer.
      3. Save the profile.
   2. In the Action and Advanced Inspection section, select the no-decrypt Decryption Profile.
5. Save the rule.
6. Move (or drag and drop) the decryption exclusion rule to the top of the rulebase.

   The NGFW enforces decryption rules against incoming traffic in the rulebase sequence and enforces the first rule that matches the traffic.
7. Save the configuration.

   Select Push ConfigPush.