PAN-OS: Configuring SSL Decryption Exclusions

Introduction: Why Exclude from Decryption?

While SSL/TLS decryption (both Forward Proxy for outbound and Inbound Inspection) provides essential visibility for security, decrypting *all* traffic is often neither feasible nor desirable. SSL Decryption Exclusions are necessary to bypass decryption for specific traffic flows due to various reasons:

Effectively managing decryption exclusions is crucial for a successful and stable decryption deployment.

Methods for Excluding Traffic from Decryption

PAN-OS provides several ways to exclude traffic, primarily through Decryption Policy rules and a dedicated exclusion list:

  1. Decryption Policy Rules (Action: "No Decrypt"):

    • Purpose: The primary and most flexible method for policy-driven exclusions based on traffic characteristics.
    • Location: Policies > Decryption
    • Configuration:
      • Create a new rule.
      • Define matching criteria (Source Zone/Address/User, Destination Zone/Address, URL Category , Service, Application).
      • Set the Action to No Decrypt .
      • Placement: These "No Decrypt" rules MUST be placed ABOVE broader "Decrypt" rules in the policy list to take effect.
      • Use Cases: Excluding sensitive URL Categories (finance, health), specific destinations (partner IPs, pinned sites via Custom URL Category or EDL), specific source users/groups, or specific applications known to break.
    • Associated Profile: You should still attach a "No Decryption" Profile ( Objects > Decryption > Decryption Profile > SSL Decryption > No Decryption ) to these rules. This allows the firewall to perform server certificate validation checks (expiry, trust) on the non-decrypted traffic (except for TLS 1.3+ where the certificate may be encrypted).

  2. SSL Decryption Exclusion List:

    • Purpose: Primarily intended for excluding specific servers/hostnames due to technical reasons , particularly certificate pinning or other incompatibility issues discovered during testing, where the site itself isn't inherently sensitive but simply doesn't work with decryption.
    • Location: Device > Certificate Management > SSL Decryption Exclusion
    • Configuration: Add specific hostnames (e.g., dropbox.com , someapp.internal.corp ). Wildcards are generally not supported here.
    • Behavior: Traffic destined for hostnames listed here will bypass decryption, regardless of Decryption Policy rules. It acts as a global technical exclusion list.
    • Use Cases: Excluding applications known to use certificate pinning that cannot be easily categorized otherwise.
    • While functional, managing large numbers of exclusions is often easier using Custom URL Categories or EDLs within "No Decrypt" policy rules, reserving this list for specific technical breakages.

Configuring Exclusions via Decryption Policy

Best Practice Approach:

  1. Identify Exclusion Needs: Determine which URL Categories, specific FQDNs, Applications, or Destinations must *not* be decrypted based on policy, privacy, or known technical issues.
  2. Create Supporting Objects (Recommended):
    • Custom URL Categories: ( Objects > Custom Objects > URL Category ) Group specific FQDNs/URLs for known problematic sites (e.g., create a category named `URL-Pinned-Apps` containing `site1.com`, `app.domain.com`).
    • External Dynamic Lists (EDLs): ( Objects > External Dynamic Lists ) Use EDLs of type 'URL' or 'Domain' to manage frequently changing lists (e.g., Office 365 URLs) or lists maintained externally.
  3. Create "No Decrypt" Profile(s): ( Objects > Decryption > Decryption Profile ) Create one or more profiles specifically for excluded traffic. Configure server certificate checks (Block expired, Block untrusted issuer) within the 'No Decryption' tab of the profile.
  4. Create "No Decrypt" Policy Rules: ( Policies > Decryption )
    • Create rules matching the traffic to be excluded. Use specific criteria:
      • Match sensitive standard URL Categories (e.g., `financial-services`, `health-and-medicine`).
      • Match your Custom URL Categories or EDLs for pinned/problematic sites.
      • Match specific Destinations/Sources/Users if required by policy.
    • Set the Action to No Decrypt .
    • Apply the appropriate "No Decryption" Profile created in the previous step.
    • Place these "No Decrypt" rules at the TOP of the Decryption policy list.
  5. Create "Decrypt" Rules: Place your broader "Decrypt" rules (matching categories like `web-mail`, `social-networking`, etc.) *below* the "No Decrypt" rules.
  6. Commit and Verify. 
# Example Decryption Policy Order:
1. Name: Exclude_Financial_Health | URL Category: financial-services, health-and-medicine | Action: No Decrypt | Profile: NoDecrypt-CertChecks
2. Name: Exclude_Pinned_Sites   | URL Category: URL-Pinned-Apps (Custom)                | Action: No Decrypt | Profile: NoDecrypt-CertChecks
3. Name: Exclude_Exec_Group     | Source User: executive-group                           | Action: No Decrypt | Profile: NoDecrypt-CertChecks
4. Name: Decrypt_WebMail_Social | URL Category: web-mail, social-networking             | Action: Decrypt    | Profile: Outbound-Decrypt-Profile
5. Name: Decrypt_General_HighRisk| URL Category: high-risk, questionable                 | Action: Decrypt    | Profile: Outbound-Decrypt-Profile
# ... other decrypt rules ...
# Default rule is implicitly 'No Decrypt'

Caveats and Security Considerations of Exclusions

Best Practices for Managing Exclusions

PCNSE Exam Focus

For the PCNSE exam, regarding Decryption Exclusions:

SSL Decryption Exclusion Quiz

1. What is the primary reason for excluding URL categories like 'financial-services' and 'health-and-medicine' from SSL Forward Proxy decryption?

Due to the highly sensitive nature of financial and health data, organizations often exclude these categories from decryption to address privacy concerns and comply with regulations like GDPR or HIPAA.

2. What is the primary mechanism used in PAN-OS to configure policy-based exclusions from decryption (e.g., excluding by URL category or destination)?

The standard and most flexible way to exclude traffic based on policy criteria (URL category, destination, source, etc.) is by creating specific Decryption Policy rules (Policies > Decryption) and setting their action to 'No Decrypt'.

3. Where must "No Decrypt" rules be placed in the Decryption Policy rulebase relative to "Decrypt" rules to be effective?

Decryption policies are processed top-down, first match. To ensure traffic intended for exclusion is actually excluded, the "No Decrypt" rule matching that traffic must be placed higher in the list than any broader "Decrypt" rule that might also match it.

4. What is the primary purpose of the SSL Decryption Exclusion list found under Device > Certificate Management > SSL Decryption Exclusion ?

This list acts as a global override mainly for technical reasons. If an application or site uses certificate pinning or other mechanisms that fundamentally break when decrypted, its hostname can be added here to force exclusion, regardless of policy rules.

5. An administrator creates a "No Decrypt" policy rule for the 'health-and-medicine' URL category. What additional configuration is recommended for this rule?

Even though the traffic isn't decrypted, attaching a "No Decryption" profile allows the firewall to still validate the original server's certificate for basic trust and expiry, providing a layer of security for non-decrypted flows (though less effective for TLS 1.3).

6. What is the main security risk associated with excluding traffic from decryption?

Excluded traffic remains encrypted as it passes through the firewall. This means security engines that rely on inspecting the payload (Threat Prevention, File/Data Filtering, detailed App-ID, granular URL filtering) cannot analyze it, creating a blind spot.

7. Which object type is commonly used within a "No Decrypt" policy rule to manage a list of frequently changing Office 365 domains that should be excluded?

EDLs are ideal for managing dynamic lists of URLs or domains maintained externally (like Microsoft's published O365 lists). Referencing an EDL in a "No Decrypt" rule ensures the firewall automatically stays up-to-date without requiring manual rule changes.

8. What issue might prevent a "No Decryption" profile from blocking a session to a site with an untrusted issuer certificate?

In TLS 1.3, parts of the handshake including the server certificate can be encrypted. This prevents the firewall from inspecting the certificate details in a non-decrypted session, potentially bypassing the "Block sessions with untrusted issuers" check in a No Decryption profile.

9. Which of these scenarios is LEAST likely to require a decryption exclusion?

General news websites typically do not fall into sensitive categories (like finance/health) and are less likely to use certificate pinning compared to specialized applications or high-security sites. They are often candidates *for* decryption rather than exclusion.

10. A best practice during the initial rollout of SSL decryption is to:

A phased rollout (pilot group or limited categories) allows administrators to identify and address technical issues (like pinning), performance impacts, and user experience problems before affecting the entire organization.