Verify that your decryption configuration decrypts the traffic you want to decrypt and doesn’t decrypt the sensitive traffic that you don’t want to decrypt.
After you configure a best practice decryption profile and apply it to traffic, you can check both the Decryption logs (introduced in PAN-OS 10.0) and the Traffic logs to verify that the firewall is decrypting the traffic that you intend to decrypt and that the firewall is not decrypting the traffic that you don’t want to decrypt. This topic shows you how to check decryption using Traffic logs. In addition, follow post-deployment decryption best practices to maintain the deployment.
- View Decrypted Traffic Sessions—Filter the Traffic Logs () using the filterMonitorLogsTraffic( flags has proxy ).This filter displays only logs in which the SSL proxy flag is on, meaning only decrypted traffic—every log entry has the value yes in theDecryptedcolumn.You can filter the traffic in a more granular fashion by adding more terms to the filter. For example, you can filter for decrypted traffic going only to the destination IP address 184.108.40.206 by adding the filter( addr.dst in 220.127.116.11 ):
- View SSL Traffic Sessions That Are Not Decrypted—Filter the Traffic Logs () using the filterMonitorLogsTraffic( not flags has proxy ) and ( app eqssl ).This filter displays only logs in which the SSL proxy flag is off (meaning only encrypted traffic) and the traffic is SSL traffic; every log entry has the valuenoin theDecryptedcolumn and the valuesslin theApplicationcolumn.Similar to the example for viewing decrypted traffic logs, you can add terms to filter the traffic that you don’t decrypt in a more granular fashion.
- View The Log for a Particular Session—To view the decryption log for a particular session, filter on the Session ID.For example, to see the log for a session with the ID 362370, filter using the term( sessionid eq 362370 ). You can find the ID number in the Session ID column in the log output, as shown in the previous screens. If the Session ID column isn’t displayed, add the column to the output.
- View All TLS and SSH Traffic—Filter the Traffic Logs () to view both decrypted and undecrypted TLS and SSH traffic, use the filterMonitorLogsTraffic( s_encrypted neq 0):
- Drill Down Into the Details—To view more information about a particular log entry, click the magnifying glass to see a detailed log view. For example, for Session ID 362370 (shown in the previous bullet), the detailed log looks like this:The box for theDecryptedflag provides a second way to verify if traffic was decrypted.You can also take upstream and downstream packet captures of decrypted traffic to view how the firewall processes SSL traffic and takes actions on packets, or perform deep packet inspection.
Recommended For You
Recommended videos not found.