In Palo Alto Networks' Single-Pass Parallel Processing (SP3) architecture, SSL/TLS decryption occurs only during the slow path when the firewall first encounters a new session.

''SSL/TLS decryption, which requires CPU-intensive cryptographic operations, is performed during the slow path when establishing new sessions. Once decrypted, traffic is processed in the fast path for subsequent packets.''

(Source: Packet Flow and SP3 Architecture)

After the initial decryption in the slow path, decrypted traffic is handled by fast path for efficiency.