Decryption Broker is a feature that allows you to use a Palo Alto Networks firewall as a decryption broker for other security devices in your network. It works by decrypting traffic on one interface and forwarding it to another interface where it can be inspected by other devices before being re- encrypted and sent to its destination. The firewall acts as a transparent bridge between the two interfaces and does not change the source or destination IP addresses of the traffic. To configure Decryption Broker, you need to assign decryption forwarding interfaces (DFIs) to the virtual router that routes the traffic that you want to inspect. The DFIs are used to forward decrypted traffic from one interface to another in a security chain. A security chain is a set of devices that perform different security functions on the same traffic flow. You can have multiple security chains for different types of traffic or different segments of your network. The reason why you need to assign DFIs to the virtual router that routes the traffic is because Decryption Broker uses routing tables to determine which DFI belongs to which security chain and how to forward traffic between them. If you assign DFIs to a different virtual router than the one that routes the traffic, Decryption Broker will not be able to find them or forward traffic correctly.