What action does a firewall take when a Decryption profile allows unsupported modes and unsupported traffic with TLS 1.2 protocol traverses the firewall?

Question

Options

• AIt blocks all communication with the server indefinitely.
• BIt downgrades the protocol to ensure compatibility.
• CIt automatically adds the server to the SSL Decryption Exclusion list.
• DIt generates a decryption error message but allows the traffic to continue decryption.

• A
  5% (2)
• B
  3% (1)
• D
  93% (37)

Explanation

When a Decryption profile is configured with 'Allow unsupported modes' enabled, the firewall's behavior for traffic it cannot fully decrypt is to generate a decryption error log entry but allow the traffic to pass through and continue the decryption attempt (D). The firewall does not block the traffic (A), as the 'allow' setting explicitly permits it to pass. It does not downgrade the protocol (B) - protocol downgrade is a separate behavior controlled by minimum version settings, not the unsupported modes option. It does not automatically add the server to the SSL Decryption Exclusion list (C) - that list requires manual or policy-based configuration. The 'allow unsupported modes' setting is specifically designed to prevent traffic disruption while still logging the condition for administrator review.

No community discussion yet for this question.