Set Up Outbound Decryption on Cloud NGFW for Azure
Focus
Focus
Cloud NGFW for Azure

Set Up Outbound Decryption on Cloud NGFW for Azure

Table of Contents

Set Up Outbound Decryption on Cloud NGFW for Azure

Learn how to set up outbound decryption on Cloud NGFW for Azure.
Where Can I Use This?What Do I Need?
  • Cloud NGFW for Azure
  • Cloud NGFW subscription
  • Palo Alto Networks Customer Support Portal account
  • Azure Marketplace subscription
With Outbound decryption, Cloud NGFW behaves like an SSL Forward Proxy, and uses its associated certificates to establish itself as a trusted third party (meddler in the middle (MitM)) for the client-server session. However, Cloud NGFW keeps your traffic packet headers and payload intact, providing complete visibility of the source’s identity to your destinations.
Use PAN-OS version 11.0.x when using Azure key vault for outbound decryption.
Outbound decryption uses two certificate objects - Trust and Untrust. The NGFW presents the trust certificate to clients during SSL decryption if the client is attempting to connect to a server that has a certificate signed by a trusted certificate authority (CA). Alternatively, the NGFW presents the untrust certificate to the client attempting to connect to a server that has a certificate signed by a CA that the NGFW does not trust.
You can configure the NGFW resource to decrypt the SSL traffic leaving your VNet or subnet. You can then enforce App-ID and security settings on the plaintext traffic, including Antivirus, Vulnerability, antispyware, URL Filtering, and file blocking profiles. After decrypting and inspecting traffic, the firewall reencrypts the plaintext traffic as it exits the firewall to ensure privacy and security.
This procedure only defines the certificates that the firewall uses for Outbound TLS decryption. Enable Outbound TLS decryption during rules creation.
  1. Select Rulestacks and select a previously created rulestack that to apply the certificate.
  2. Select Encrypted Threat ProtectionEgress Decryption.
  3. Select a certificate.
    • Select an Untrust Certificate.
    • Select a Trust Certificate.
    Add a Certificate to Cloud NGFW for Azure if you have not done so already.
    The certificate and private key are stored in the Azure key vault, and the workload uses this information to decrypt the traffic.
    The certificate must be a CA certificate. Set the CA value in the Basic Constraints to TRUE. The following is an example private CA certificate.
    Certificate: Data: Version: 3 (0x2) Serial Number: 4121 (0x1019) Signature Algorithm: sha256WithRSAEncryption Issuer: C=US, ST=Washington, L=Seattle, O=Example Company Root CA, OU=Corp, CN=www.example.com/emailAddress=corp@www.example.com Validity Not Before: Feb 26 20:27:56 2018 GMT Not After : Feb 24 20:27:56 2028 GMT Subject: C=US, ST=WA, L=Seattle, O=Examples Company Subordinate CA, OU=Corporate Office, CN=www.example.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:c0: ... a3:4a:51 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: F8:84:EE:37:21:F2:5E:0B:6C:40:C2:9D:C6:FE:7E:49:53:67:34:D9 X509v3 Authority Key Identifier: keyid:0D:CE:76:F2:E3:3B:93:2D:36:05:41:41:16:36:C8:82:BC:CB:F8:A0 X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: critical Digital Signature, CRL Sign Signature Algorithm: sha256WithRSAEncryption 6:bb:94: ... 80:d8
    If you're using an End-Entity certificate for decrypting traffic, only the End Entity Cert with public and private key is stored in the Azure key vault.
    PKCS8 is the supported certificate format.
    Trust certificates can’t be self-signed, but the untrust certificate can be self-signed or ca-signed.
  4. Navigate to the previously created Rulestack and go to the Managed Identity page.
  5. From the Enable MI dropdown menu, select the managed identity that was associated with the key vault.
  6. Click Save.