An engineer configures SSL decryption in order to have more visibility to the internal users' traffic when it is regressing the firewall. Which three types of interfaces support SSL Forward Proxy? (Choose three.)

SSL Forward Proxy requires the firewall to be deployed inline to intercept, decrypt, and re-encrypt traffic. Layer 3, Layer 2, and Virtual Wire are all inline deployment modes that process transit traffic. Security policies, including Decryption policies, can be applied to traffic flowing through these interface types, allowing the firewall to act as the required man-in-the-middle for SSL Forward Proxy.

A. High availability (HA): HA interfaces are dedicated control links for state synchronization and heartbeat monitoring; they do not process user transit traffic and cannot apply decryption policies.
D. Tap: Tap interfaces receive a passive copy of traffic for monitoring. Because they are not inline, they cannot intercept or proxy traffic, which is a requirement for SSL Forward Proxy.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. Decryption. "You can configure decryption for traffic that passes through Layer 2, Layer 3, virtual wire, and tunnel interfaces."

2. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. Interface Types. "The firewall supports the following interface types... Tap, HA, Decrypt Mirror, Log Card, Virtual Wire, Layer 2, Layer 3..."

3. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. Tap Interfaces. "In a tap deployment, the firewall monitors traffic flowing across a network by using the switch SPAN or mirror port... The firewall cannot control the traffic flow in tap mode..."

4. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. Virtual Wire Interfaces. "A virtual wire logically connects two firewall interfaces... This allows the firewall to be easily inserted into an existing topology... You can apply Security, QoS, and DoS Protection policy rules to traffic that traverses the virtual wire."

5. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. Layer 2 Interfaces. "In a Layer 2 deployment, the firewall is installed transparently on a network segment... You can apply Security, QoS, and DoS Protection policy rules to the VLANs to which the Layer 2 interfaces are assigned."