This approach balances the operational goal of using dynamic address groups with immediate security. It allows the tags to populate the groups while ensuring that any traffic not matching known-good patterns (caught by the strict security profiles) is blocked or scrutinized, preventing a permissive ‘any-any’ scenario during migration.

Decryption logs, when configured with the ‘Decryption Log Forwarding’ setting that includes detailed metrics, provide granular data such as handshake time, decryption time, and key exchange time. This is the definitive source for analyzing the performance impact of the decryption process on specific sessions, unlike more general session or ACC data.

In a virtual wire (Layer 2) deployment, the primary method to handle asymmetric traffic is to enable the ‘Enable Asymmetric Path’ option. This allows the firewall to accept packets that are part of a session initially handled by its peer. Additionally, both interfaces in the virtual wire pair must belong to the same security zone for policy enforcement to work correctly with this feature.

Dynamic Address Groups (DAGs) linked to tags from cloud or virtualization orchestrators (like VMware NSX-T, AWS tags, Azure tags) are the native, dynamic, and scalable solution. When a server VM moves, its interface tag follows it, and the DAG membership updates automatically, keeping the security policy accurate without manual intervention.

While priority queuing gives traffic preferential treatment, it does not by itself guarantee a minimum bandwidth. Configuring a guaranteed bandwidth percentage within the QoS profile for that traffic class ensures it will receive that minimum allocation of the interface’s capacity before best-effort traffic is serviced, providing a firm service level agreement (SLA) for the application.

Mismatched HA encryption settings (e.g., one firewall set to encryption and the other not) or an incorrect passphrase will prevent the secure exchange of configuration and session state data over the HA1 (control) link, even if the link is physically up. This is a common cause for failed synchronization and should be verified immediately.

Palo Alto Networks App-ID can identify DoH traffic as an ‘ssl’ sub-application. The most effective method is to create a rule that uses an Application Filter (not a single App-ID) to match *either* the traditional ‘dns’ application *or* the ‘ssl’ application, but only when destined for the authorized internal resolver IP addresses. This allows both clear-text DNS and encrypted DoH to the correct destinations.

Certificate pinning is designed to prevent man-in-the-middle decryption. The correct operational practice is to create a security policy rule *above* the general decryption rule that matches the traffic for that specific pinned application (using its FQDN) and has the Decryption setting set to ‘No’. This bypasses decryption for that app only, allowing it to function, while maintaining inspection for all other traffic.

This method meets the requirement precisely. The first rule allows and inspects the specific traffic. The second rule, placed below it, uses an ‘allow’ action (to permit the flow for logging purposes) but has no Security Profiles attached, meaning it only performs App-ID. Crucially, its log setting is configured for ‘All sessions’ or ‘At session start’, generating the required flow logs for audit. The action is ‘allow’ to let the traffic pass for logging, but without inspection, which is functionally similar to a monitor-only rule for audit trails.

This approach balances the operational goal of using dynamic address groups with immediate security. It allows the tags to populate the groups while ensuring that any traffic not matching known-good patterns (caught by the strict security profiles) is blocked or scrutinized, preventing a permissive ‘any-any’ scenario during migration.0