Create a Decryption Policy Rule
Decryption policy rules granularly define the traffic to decrypt or not to decrypt based on the source, destination, service (application port), and URL Category.
Create a decryption policy rule to define traffic for the firewall to decrypt and the type of decryption you want the firewall to perform: SSL Forward Proxy, SSL Inbound Inspection, or SSH Proxy decryption. You can also use a decryption policy rule to define Decryption Mirroring.
- Add a new decryption policy rule.Select PoliciesDecryption, Add a new decryption policy rule, and give the policy rule a descriptive Name.
- Configure the decryption rule to match to traffic based
on network and Policy
The application-default setting can be useful when you Create a Policy-Based Decryption Exclusion. You can exclude applications running on their default ports from decryption, while continuing to decrypt the same applications when they are detected on non-standard ports.
- Firewall security zones—Select Source and/or Destination to match traffic based on the Source Zone and/or the Destination Zone.
- IP addresses, address objects, and/or address groups—Select Source and/or Destination to match traffic based on Source Address and/or the Destination Address. Alternatively, select Negate to exclude the source address list from decryption.
- Users—Select Source and set the Source User for whom to decrypt traffic. You can decrypt specific user or group traffic, or decrypt traffic for certain types of users, such as unknown users or pre-logon users (users that are connected to GlobalProtect but are not yet logged in).
- Ports and protocols—Select Service/URL Category to set the rule to match to traffic based on service. By default, the policy rule is set to decrypt Any traffic on TCP and UDP ports. You can Add a service or a service group, and optionally set the rule to application-default to match to applications only on the application default ports.
- URLs and URL categories—Select Service/URL Category and decrypt traffic based on:
- An externally-hosted list of URLs that the firewall retrieves for policy-enforcement (see ObjectsExternal Dynamic Lists).
- Custom URL categories (see ObjectsCustom ObjectsURL Category). For example, you can create a custom URL Category to specify a group of sites you need to access for business purposes but that don’t support the safest protocols and algorithms, and then apply a customized Decryption profile to allow the looser protocols and algorithms for just those sites (that way, you don’t decrease security by downgrading the Decryption profile you use for most sites).
- Palo Alto Networks predefined URL categories. This option is useful when you create policy-based decryption exclusions because you can exclude sensitive sites by category instead of individually. For example, although you can create a custom URL category to group sites that you do not want to decrypt, you can also exclude financial or healthcare-related sites from decryption based on the predefined Palo Alto Networks URL categories. You can also block risky URL Categories and create comfort pages to communicate the reason the sites are blocked or Enable Users to Opt Out of SSL Decryption.
- Set the rule to either decrypt matching traffic or to
exclude matching traffic from decryption.Select Options and set the policy rule Action:To decrypt matching traffic:
To exclude matching traffic from decryption:Set the Action to No Decrypt.
- Set the Action to Decrypt.
- Set the Type of decryption for the firewall to perform on matching traffic:
- (Optional) Select a Decryption Profile to perform
additional checks on traffic that matches the policy rule.Although applying a Decryption profile to decrypted traffic is optional, it is a best practice to always apply a Decryption profile to the policy rules to protect your network against encrypted threats. You can’t protect yourself against threats you can’t see.For example, attach a decryption profile to a policy rule to ensure that server certificates are valid and to block sessions using unsupported protocols or ciphers. To Create a Decryption Profile, select ObjectsDecryption Profile.
- Create a decryption policy rule or open an existing rule to modify it.
- Select Options and select a Decryption Profile to
block and control various aspects of the traffic matched to the
rule.The profile rule settings the firewall applies to matching traffic depends on the policy rule Action (Decrypt or No Decrypt) and the policy rule Type (SSL Forward Proxy, SSL Inbound Inspection, or SSH Proxy). This allows you to use the different decryption profiles with different types of decryption policy rules that apply to different types of traffic and users.
- Click OK.
- Click OK to save the policy.
- Choose your next step to fully enable the firewall to
- Configure SSL Forward Proxy
- Configure SSL Inbound Inspection
- Configure SSH Proxy
- Create policy-based Decryption Exclusions for traffic you choose not to decrypt and add sites that break decryption for technical reasons such as pinned certificates or mutual authentication to the SSL Decryption Exclusion list.
Create a Decryption Profile
Attach Decryption profiles to Decryption policy rules to control the protocol versions, algorithms, verification checks, and session checks the firewall accepts for the traffic defined ...
Configure SSH Proxy
SSH Proxy decryption requires no certificates and decrypts inbound and outbound SSH sessions and ensures that attackers can’t use SSH to tunnel potentially malicious applications ...
Decrypt traffic to reveal encrypted threats so the firewall can protect your network against them. ...
Policies > Decryption
Policies > Decryption You can configure the firewall to decrypt traffic for visibility, control, and granular security. Decryption policies can apply to Secure Sockets Layer ...
Decryption Options Tab
Decryption Options Tab Select the Options tab to determine if the matched traffic should be decrypted or not. If Decrypt is set, specify the decryption ...
Create a Policy-Based Decryption Exclusion
Exclude traffic that you choose not to decrypt for legal, privacy, or business reasons from decryption to comply with those policies while still applying SSL ...
Decrypt Traffic for Full Visibility and Threat Inspection
Decrypt Traffic for Full Visibility and Threat Inspection The best practice security policy dictates that you decrypt all traffic except sensitive categories, which include Health, ...
Create the Data Center Best Practice Decryption Profiles
Decryption Profiles define the SSL Protocol settings the firewall accepts so you can protect against vulnerable, weak protocols and algorithms. ...
Configure Server Certificate Verification for Undecrypted T...
Even though the traffic is encrypted, you can protect your network against sessions with expired certificates and untrusted issuers for traffic you choose not ...