Threat Prevention does not scan the TLS handshake when SSL Decryption is enabled

1624

Created On 02/04/22 20:02 PM - Last Modified 11/02/24 01:44 AM

Anti-spyware

SSL Forward Proxy

SSL Inbound Inspection

URL Category

Vulnerability Protection

Decryption

Threat Prevention

URL Filtering

Next-Generation Firewall

Symptom

When SSL Decryption is enabled, URL Filtering and Threat Prevention does not scan TLS handshake messages.

The PAN-OS default Threat Prevention packet flow logic will skip (not scan) TLS handshakes when SSL Decryption is enabled.

TLS Handshake scanning is supported with PAN-OS 10.1.
To enable the scan-handshake logic:
1. Make sure you are running PAN-OS 10.1 or newer.
2. GUI: Device > Setup > Session > Decryption Settings > SSL Decryption Settings > and enable the checkbox titled "Send handshake messages to CTD for inspection".
3. Commit the changes.

CLI command:

> configure
# set deviceconfig setting ssl-decrypt scan-handshake yes
# commit
# exit