Which NGFW function can be used to enhance visibility, protect, block, and log the use of Post- quantum Cryptography (PQC)?

The Decryption Profile in a Palo Alto Networks NGFW defines the parameters for handling SSL/TLS sessions, including which protocol versions, key exchange algorithms, and cipher suites are permitted. To specifically manage Post-quantum Cryptography (PQC), an administrator configures a Decryption Profile to identify and block sessions that attempt to use PQC algorithms for key exchange. This provides granular control, visibility through logs, and protection against potentially untrusted or unsupported cryptographic methods, directly addressing the question's requirements.

A. DNS Security profile: This profile focuses on disrupting attacks that use DNS for C2 or data theft; it does not inspect or control cryptographic algorithms within traffic sessions.
B. Decryption policy: This policy determines which traffic should be subjected to decryption based on criteria like source, destination, or URL category, not how the cryptographic handshake is handled.
C. Security policy: This policy allows or denies traffic based on high-level attributes like application, user, and service, but it lacks the deep-packet inspection capability to control specific crypto algorithms.

1. Palo Alto Networks. (2023). PAN-OS® 11.1 New Features Guide.

Section: Decryption > Post-Quantum Cryptography (PQC) Protection.

Content: "You can now create a Decryption profile to block sessions that use PQC algorithms for key exchange. This allows you to gain visibility into PQC algorithm usage in your network and prevent its use until you are ready to adopt it." This directly confirms that the Decryption Profile is the correct feature.

2. Palo Alto Networks. (2023). PAN-OS® 11.1 Administrator's Guide.

Section: Objects > Decryption > Decryption Profile > SSL Protocol Settings Tab.

Content: This section details the configuration options within a Decryption Profile, including controls for key exchange algorithms, encryption algorithms, and authentication algorithms. It is within these settings that an administrator would configure the firewall to block sessions using specific algorithms like those associated with PQC. The guide states you can "Block sessions with unsupported algorithms."