Which NGFW function can be used to enhance visibility, protect, block, and log the use of Post- quantum Cryptography (PQC)?

The Decryption profile is the specific component within the Palo Alto Networks NGFW that defines how to handle encrypted traffic. It allows administrators to configure granular controls over the cryptographic parameters of a session, such as blocking sessions with unsupported versions or weak ciphers. With the introduction of PAN-OS 11.1, this functionality was extended to include Post-quantum Cryptography (PQC). Administrators can now create policies within the Decryption profile to specifically log, block, or allow TLS sessions that use PQC algorithms, thereby providing the visibility and control required by the question.

A. DNS Security profile: This profile targets threats within DNS traffic, such as sinkholing malicious domains, and does not inspect or control the cryptographic algorithms used in TLS sessions.

B. Decryption policy: This policy determines what traffic to decrypt based on rules (source, destination, etc.). It does not define the specific cryptographic handling, which is the role of the Decryption profile.

C. Security policy: This policy allows or denies traffic based on attributes like application, user, and content. It acts on traffic after identification and decryption but does not control the cryptographic parameters of the session itself.

1. Palo Alto Networks. (2023). PAN-OS® 11.1 New Features Guide.

Section: Decryption > Post-Quantum Cryptography Visibility and Control.

Content: "To provide you with visibility and control over the use of PQC in your network

you can now configure your firewall to log

block

or allow sessions that use PQC algorithms. You can configure this in a Decryption profile..." This directly states that the Decryption profile is the feature used for PQC control.

2. Palo Alto Networks. (2023). PAN-OS® 11.1 Administrator's Guide.

Section: Objects > Decryption > Decryption Profile > Create a Decryption Profile.

Content: The guide details the configuration tabs within a Decryption profile. The "SSL Protocol Settings" tab includes a specific section for "Post-Quantum Cryptography" where an administrator can select an action: allow

block

or log. This confirms the precise location of the PQC control function.