URL Category Inconsistently Not Matching Due to Split Client Hello (SSL Decryption Disabled)

• Websites that should be blocked by URL Filtering profiles are inconsistently allowed.
• HTTPS traffic may match the incorrect security policy because the firewall cannot determine the correct URL category.
• Session tracker state shows ctd sw looping for the allowed session.
• Checking global counters reveals an actively increasing value for ssl_partial_client_hello (which tracks the number of SSL sessions with Client Hellos that do not fit in one packet) and ctd_sml_vm_run_impl_looping.

• PAN-OS Firewalls 11.2.7 or higher.
• SSL Decryption is not enabled.
• Users are running modern web browsers (such as Google Chrome) with Post-Quantum Cryptography (PQC) Kyber Key Encapsulation Mechanism (KEM) enabled.

For HTTPS traffic without SSL Decryption enabled, the firewall relies on the Server Name Indication (SNI) field within the TLS Client Hello message to determine the URL category. 

With the advent of PQC algorithms like Kyber, the key share extension in the Client Hello becomes large enough that the payload spans two or more TCP segments. When the Client Hello is fragmented, the firewall may make a policy decision based on the incomplete first packet.

Because the SNI cannot be successfully parsed from the partial data, the firewall categorizes the traffic incorrectly, leading to unexpected policy matches and allowed traffic.

Configure a dummy SSL Decryption policy with the action set to No Decrypt for the affected traffic. The action of evaluating a decryption policy triggers the firewall's Accumulation Proxy, which will successfully accumulate the split Client Hello packets, parse the SNI, and correctly categorize the URL without actually decrypting the payload.