A network administrator is troubleshooting an issue where users are reporting slow performance and intermittent connection drops when accessing websites that use SSL/TLS, even though SSL decryption is enabled on the Palo Alto Networks firewall. The firewall's resource monitor shows high CPU utilization on the data plane, particularly related to SSL processes. Which action would be most effective in immediately alleviating the performance bottleneck while further investigation takes place?
- AUpgrade the firewall's hardware to a more powerful model.
- BDisable SSL decryption for all traffic.
- CIncrease the maximum number of concurrent SSL sessions allowed.
- DBypass SSL decryption for less critical applications or categories.
Show answer & explanationAnswer & explanation
Correct answer: D. Bypass SSL decryption for less critical applications or categories.
High CPU utilization during SSL decryption indicates the firewall is struggling to process the decryption workload. Immediately disabling decryption for less critical traffic (e.g., streaming, social media, or specific categories) or trusted sites will reduce the decryption load on the CPU, providing immediate relief and allowing the administrator to investigate the root cause without completely sacrificing decryption for critical traffic.
Why the other options are wrong
- A. Upgrading hardware is a long-term solution, not an immediate troubleshooting step to alleviate an ongoing performance bottleneck.
- B. Disabling SSL decryption for all traffic would alleviate the load but completely compromise security visibility, which is often not acceptable.
- C. Increasing concurrent SSL sessions would likely worsen the CPU utilization rather than alleviate it, as it allows more decryption, not less.
SSL Decryption Performance Optimization
To mitigate high CPU utilization from SSL decryption, selectively bypassing decryption for less critical traffic or trusted categories can provide immediate performance relief.
- Decryption is resource-intensive.
- Bypassing reduces CPU load.
- Start with categories like 'financial-services' (no-decrypt) or 'streaming-media' (decrypt-no-inspect).
Memory trick: Bypass the non-essentials to boost the firewall's essentials.