Decryption Application Command Center (ACC) Widgets
| Where Can I Use
This? | What Do I Need? |
|---|
|
|
Depending on the products you're using, you need at least one
of...
- For Prisma Access (Managed by Panorama):
If you're using a NGFW (Managed by PAN-OS or Panorama), no other
requirements.
|
Decryption logs and the
SSL Activity Widgets in the Application
Command Center (ACC) provide powerful decryption troubleshooting tools that work
both independently and together. When you gain an understanding of how to use these
tools, you can investigate and address a wide range of decryption issues. The
following examples show you how to use the troubleshooting tools to identify,
investigate, and address decryption issues. Apply these methods to troubleshoot any
issues you encounter in your decryption deployment.
The Application Command Center (ACC) widgets for decryption () introduced in PAN-OS 11.1 work with decryption logs to help you
diagnose and resolve decryption issues quickly and easily. Use the SSL
Activity widget to view and analyze network decryption activity such
as the number of decrypted and undecrypted sessions, how much traffic uses different
TLS protocol versions, the most common decryption failure reasons, and which
applications and Server Name Identifications (SNIs) use weak ciphers and algorithms.
Next, use the decryption logs to drill down into sessions and diagnose the exact
issue so you can take appropriate action.
PAN-OS 11.1 introduced five new decryption widgets. Use the information the widgets
provide to identify misconfigured decryption policy rules and profiles and make
informed decisions about what traffic to allow and block:
Traffic Activity—Shows SSL/TLS activity compared to non-SSL/TLS
activity by total number of sessions or amount of traffic in bytes.
SSL/TLS Traffic—Shows the amount of decrypted and undecrypted traffic
by number of sessions or amount of traffic in bytes. Reasons for traffic not
being decrypted include:
No decryption policy rule is applied to the traffic.
The decryption policy rule intentionally exempted the traffic from
decryption (for example, a no-decryption policy rule).
The decryption policy rule was misconfigured and the traffic was
intended to be decrypted but is not.
The site is in the
SSL decryption
exclusion list (), which contains sites Palo Alto Networks has
identified that break decryption for technical reasons such as
pinned certificates or client authentication. For these sites, the
NGFW bypasses decryption.
The ACC only populates the next three widgets with data from traffic that a
decryption policy rule controls. If you don’t apply a decryption policy rule to
traffic, that traffic does not populate these widgets.
Decryption Failure Reasons—Shows the reasons for decryption failures:
protocol, certificate, version, cipher, HSM, resource, resume, or feature
issues, by SNI. Use this information to detect problems caused by decryption
policy rule or profile misconfigurations or by traffic that uses unsupported
weak protocols or algorithms. Click a failure reason to drill down and
isolate the number of sessions per SNI that experienced the failure or click
an SNI to see all of the decryption failures for that SNI.
Successful TLS Version Activity—Shows successful TLS connections by
TLS version for applications or SNIs (SNIs are available for Forward Proxy
only) so you can evaluate how much risk you are taking on by allowing weaker
TLS protocol versions. Identifying applications and SNIs that use weak
protocols enables you to evaluate each one and decide whether you need to
allow access to it for business reasons. If you don’t need the application
for business purposes, you may want to block the traffic instead of allowing
it to reduce risk. Click a TLS version to drill down and view the SNIs or
applications that used that TLS version. Click an application or an SNI to
drill down and see how many of those application or SNI sessions used each
TLS version.
Successful Key Exchange Activity—Shows successful key exchange
activity per algorithm for applications or SNIs (SNIs are available for
Forward Proxy only). Click a key exchange algorithm to see the activity for
just that algorithm or click an application or SNI to view the key exchange
algorithm activity for that application or SNI.
The following example of drilling down into ACC data shows you how to examine
successful TLS version activity:
The Successful TLS Version Activity widget shows that
17 sessions used TLSv1.3 and seven sessions used TLSv1.2. The SNI list shows
the destination SNIs and the number of sessions per SNI.
To see which SNIs used TLSv1.2, click the green bar labeled TLSv1.2.
Now, you can see the seven TLSv1.2 sessions were spread among four
servers.
Clicking Home returns to the home screen. Now,
clicking the www.espn.com SNI shows us which TLS versions it used. We can
see that two of the four sessions used TLSv1.3 and two used TLSv1.2.
For any decryption widget, click the Jump to Logs icon to jump directly to the
decryption logs that correspond to the data in the ACC:
In the preceding example, at any point in the investigation you could jump to the
decryption logs for the data to drill down more. For example, you could examine the
logs for the individual sessions that used TLSv1.2 to find out why they didn’t use
TLSv1.3.
Decryption ACC widgets show the name of the decrypted application based on the Palo
Alto Networks App-ID. For populating the ACC, the
NGFW can only
identify applications that have a Palo Alto Networks App-ID; the
NGFW
can’t populate the ACC with custom applications or applications that do not have an
App-ID.
Content updates update App-IDs regularly. Other
reasons that the application may be shown as incomplete or unknown are:
The NGFW dropped the session before it could identify the
application.
Decryption logs depend on Traffic logs to populate the decryption log
application field. However, if the Traffic log isn’t completed in 60 seconds
or less, the Traffic log does not populate the application in the decryption
log and the application displays as incomplete or unknown.
