To inspect encrypted HTTPS traffic, you must create a Decryption policy rule. This rule explicitly tells the firewall to decrypt the specified traffic. While a Security profile group is needed for threat inspection *after* decryption, and setting the service correctly is important, the Decryption rule is the mandatory first step. The application should not be set to ‘ssl’ in the Security policy; it would be identified dynamically.

The ACC provides a real-time, visual breakdown of the traffic matching a specific policy rule. It shows the exact applications, source/destination IPs, and ports, which is the quickest way to understand *why* the rule is being hit so frequently (e.g., is it truly all web browsing, or is other traffic being misclassified?). This is more efficient than a packet capture or CLI test for an initial, broad investigation.

Policy-Based Forwarding (PBF) is designed to override the firewall’s routing table based on specific criteria (like source IP/subnet). A PBF rule can redirect traffic from the finance subnet to the IP and port of the explicit proxy server, forcing it to use the proxy without affecting other departments. Security policies control allow/deny and inspection, not path selection, which is the role of PBF.

Palo Alto Networks firewalls are application-aware. If the firewall cannot identify the legacy protocol with its built-in App-IDs, it will default to ‘unknown-tcp’ or ‘unknown-udp’ application, which may be denied by the policy. The correct action is to create a custom Application object based on the specific signature (ports, characteristics) of the legacy protocol, allowing the Security policy to correctly match and permit it.

GlobalProtect Clientless VPN allows external users to access specific internal web resources through their standard browser without installing a VPN client. It acts as a secure reverse proxy, eliminating the need for inbound NAT rules or full network-level VPN access. This is ideal for providing limited, application-specific access to partners.

The Security Policy Optimizer is specifically designed for this purpose. It analyzes your rulebase and traffic logs to identify rules with unused applications/services, suggest removing ‘any’ from service/application fields, and highlight shadowed rules. It provides actionable recommendations to tighten policies according to least privilege, making it the most direct tool for an audit request.

While the Session Browser shows active connections and the Threat logs show detected attacks, a packet capture is the lowest-level tool. It allows you to see the raw packets (including headers and payload) arriving on the server’s interface, which is essential for identifying malformed packets, protocol anomalies, or traffic patterns that higher-level logs might not reveal.

A Data Filtering profile is designed to control file transfers based on file type and size. By creating one rule that uses the pre-defined ‘cloud-storage’ application group as the application and attaching a Data Filtering profile set to ‘alert’ on all transfers and ‘block’ on transfers >100MB, you achieve both the logging and blocking requirements in a single, manageable rule.

For a user-based policy to work, two things must be true: 1) The firewall must know the user-to-IP mapping (which is happening), and 2) The traffic from that user’s IP must pass through the same firewall/vsys where the user-aware policy rule exists. If the traffic is taking a different network path (bypassing the firewall), the policy cannot be evaluated and enforced, even if the user is correctly identified.

To inspect encrypted HTTPS traffic, you must create a Decryption policy rule. This rule explicitly tells the firewall to decrypt the specified traffic. While a Security profile group is needed for threat inspection *after* decryption, and setting the service correctly is important, the Decryption rule is the mandatory first step. The application should not be set to ‘ssl’ in the Security policy; it would be identified dynamically.0