The App-ID for ‘ssl’ relies on decrypting the traffic to identify the SSL protocol and complete the handshake. If SSL decryption is not enabled on the rule (or globally), the firewall cannot properly identify the application as ‘ssl’ and the application override will not take effect. The traffic would then be matched by a different App-ID or default to ‘unknown-tcp’, likely leading to a deny.

Vulnerability Protection profiles are focused on network-based exploits that target software vulnerabilities (e.g., buffer overflows, SQL injection). They use signatures for known exploits. Anti-Virus profiles are designed to detect and block malicious files (e.g., executables, documents) using signatures for known malware and, in some cases, heuristic analysis. Their core targets are different layers of the threat landscape.

Configuring the specific security policy rule with the Action set to ‘no-decrypt’ is the precise and recommended method. This allows you to maintain a broad decryption policy for other web traffic (using ‘decrypt’ actions) while creating a targeted exception for the problematic application. Decryption Exclusions (option A) are a broader, less precise mechanism typically managed in the decryption profile settings, not directly tied to the security policy logic.

A key principle in Palo Alto Networks firewalls is that a security policy rule with ‘any’ for both source and destination zones only matches inter-zone traffic. Intra-zone traffic (where source and destination interfaces belong to the same zone) is not evaluated by this rule unless the zones are explicitly specified as the same zone. To control intra-zone traffic, a rule must have the specific zone named in both the source and destination fields.

The most efficient first step is always to investigate using the tools available. Checking the Security policy log (or the URL Filtering log) for the blocked session will show you the actual category the firewall has assigned to the requested URL. The site might be mis-categorized (e.g., as ‘adult’ or ‘high-risk’), which the log will reveal. This evidence-based approach informs your next action, whether it’s a re-categorization request or a custom exception.

In an Active-Passive HA configuration, the firewalls use a dedicated HA control link to synchronize critical information. This includes the configuration (config sync) and, more importantly, session and runtime state (session sync) like the session table, GTP/PPPoE tables, and IPSec security associations. This synchronization is continuous and in near real-time, ensuring the passive firewall has the necessary information to seamlessly assume traffic processing without dropping existing connections.

The firewall identifies HTTP traffic as the ‘web-browsing’ application and HTTPS traffic as the ‘ssl’ application (which may then be further classified as ‘web-browsing’ after decryption). If the policy rule only lists ‘web-browsing’, it only permits traffic identified as plain HTTP. HTTPS traffic is identified as ‘ssl’ and would be blocked unless ‘ssl’ is also added to the rule’s application list or a separate rule allows it.

This is a fundamental architectural concept. The two policy types have distinct purposes. The Security policy (also called the Policy rule) is the access control list that makes the allow/deny decision based on zones, addresses, users, applications, etc. The NAT policy (Pre-NAT or Post-NAT) is responsible for modifying the source or destination IP address and port in the packet header. They work in conjunction but enforce different aspects of policy.

The Traffic Log is the primary log for all traffic that has been processed by the security policy. It records both allowed and denied sessions. For denied sessions, it provides the essential details: source, destination, application, and, crucially, the ‘Action’ (deny) and the ‘Rule’ that caused the deny. While specialized logs (Threat, URL) provide deep details for specific block types, the Traffic Log is the central, comprehensive source for all policy-based block events.

The App-ID for ‘ssl’ relies on decrypting the traffic to identify the SSL protocol and complete the handshake. If SSL decryption is not enabled on the rule (or globally), the firewall cannot properly identify the application as ‘ssl’ and the application override will not take effect. The traffic would then be matched by a different App-ID or default to ‘unknown-tcp’, likely leading to a deny.0