Used the “test decryption-policy-match” command:
corderoPA-A(active)> test decryption-policy-match source {SOURCE-IP} destination {DESTINATION-IP}
Matched rule: 'Do Not Decrypt' action: no-decrypt
Palo Alto – SSL Decrypt Test Which Policy is Used CLI
