Proxy Decryption (PAN-OS 9.1.12 and
later releases) | Beginning in PAN-OS 9.1.12, the firewall denies web sessions if a client presents a truncated
Client Hello message that lacks critical information, such as
supported cipher suites and TLS versions. Without this information,
the firewall can't accurately decrypt the session.
Sessions with traffic excluded from decryption might also be denied if the Client Hello is
truncated and missing critical information. If critical information
is present in the truncated Client Hello, the firewall attempts decryption.
Specifically, the firewall examines the first packet of the truncated
Client Hello for the Server Name Indication (SNI) extension. The firewall
can use the SNI value to identify and apply the matching Decryption
policy rule to the traffic. In the absence of an SNI value in the
first packet, the firewall makes a best-effort match to a Decryption policy
rule.
SNI parsing is opportunistic. Even if an SNI value is present in the first packet, a Decryption
policy rule mismatch can occur. In PAN-OS 9.1 and earlier, the firewall attempted
to decrypt web sessions with incomplete Client Hello messages even
if the message was missing critical information. SNI values were
not used to match traffic with a Decryption policy rule. This made
traffic more susceptible to policy rule mismatches. To allow the firewall to process web sessions with incomplete Client Hellos that are missing
critical information, use the debug proxy
discard-partial-client-hello enable no CLI command.
The firewall will also examine the first packet for an SNI value.
The CTD engine will discard sessions if its traffic matches a known
threat pattern. If the traffic doesn't match a known threat, the CTD
engine may allow the session to continue undecrypted. | 