Advanced Security Configuration: Threat Prevention, Decryption, and VPN
Advanced configuration combines security profiles, decryption policy, and VPN. Profiles (Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, WildFire, DNS Security, Data Filtering, Credential Phishing Prevention) are attached to security rules and act only on traffic the rule permits - a rule with an allow action and no profile inspects nothing beyond App-ID. Profiles group best-practice or custom configurations; profile groups simplify attachment.
Decryption policy is evaluated before security policy and determines what can be inspected. SSL forward proxy requires a forward trust certificate (issued from an internal CA) and a forward untrust certificate; inbound inspection uses a certificate imported for the published server. no-decrypt rules for certificate-pinned applications, financial and health categories, and unsupported ciphers should be placed above the decrypt rules - order is the classic trap, since a broad decrypt rule above a no-decrypt exception silently breaks the exception.
VPN configuration splits into site-to-site IPsec (IKEv1/IKEv2, crypto profiles, tunnel interfaces, proxy IDs or routed-based VPN) and GlobalProtect (portal, gateway, client config, HIP checks, split tunneling). GlobalProtect troubleshooting usually starts with the portal vs gateway configuration source and whether the client's config was delivered from the right source.
Rule of thumb: decrypt what you can, exclude deliberately and narrowly, and always attach profiles to the security rules that allow the traffic - decryption without threat profiles buys visibility but not protection.