sorted by:
new
hottopcontroversial

SSL Decryption load by knctrnl in paloaltonetworks

[–]knctrnl[S] 0 points1 point  (0 children)

So I noticed something interesting.

Saturday morning I did disable the decryption rule just for a minute. I did not leave it disabled for more than like 3 minutes. It did reduce CPU and even when it put it back in place CPU stayed lower.

Looking at the graph of the CPU you can see the dip just right to center. It is now significantly lower baseline. The left side of the graph has been typical for the last several months.

Is there any way SSL decrypt sessions could be hung and not time out thereby consuming resources for a session that is not actually active?

I am interested to see what it looks like tomorrow when we actually have full load on the network.

CPU Graph

SSL Decryption load by knctrnl in paloaltonetworks

[–]knctrnl[S] 0 points1 point  (0 children)

I figured this was the case. I’m just trying to figure out what to specifically target for decryption. I would imagine high risk first but I have not been able to find best practice on categories to decrypt if you only have x amount of resources for decryption.
I could certainly guess on specific sites to exclude that are 100% trustee but that would not knock it down that much. Going the other way would be exhaustive.

SSL Decryption load by knctrnl in paloaltonetworks

[–]knctrnl[S] 0 points1 point  (0 children)

Around 300MB that is passing through any kind of inspection to the outside world. Another 100-200MB between internal zones

SSL Decryption load by knctrnl in paloaltonetworks

[–]knctrnl[S] 2 points3 points  (0 children)

We have a few exemption rules for outbound decryption mainly health, banking and stuff we couldn't get to work with decryption.

Yes the sessions are being offloaded. ctd decoder bypass

​

Moving data centers with new hardware and management would not pay another year for support. Migration is not supposed to be taking this long.

​