Learn how to configure ingress decryption on Cloud NGFW for AWS.
| Where Can I Use This? | What Do I Need? |
|---|
|
|
- Cloud NGFW subscription
- Palo Alto Networks Customer Support Account (CSP)
- AWS Marketplace account
- User role (either tenant or administrator)
|
Cloud NGFW uses
SSL Inbound Decryption to inspect and
decrypt inbound SSL/TLS traffic from a client to a targeted network server (any
server you have the certificate for and can import onto the firewall) and block
suspicious sessions. The firewall acts as a proxy between the external client and
the internal server and generates a new session key for each secure session. The
firewall creates a secure session between the client and the firewall and another
secure session between the firewall and the server to decrypt and inspect the
traffic. However, Cloud NGFW keeps your traffic packet headers and payload intact,
providing complete visibility of the source’s identity to your applications in your
VPCs.
Your
certificate and session keys are stored on
the
AWS secrets manager to perform SSL Inbound
Inspection . The firewall validates that the certificate sent by the targeted server
during the SSL/TLS handshake matches a certificate in your decryption policy rule.
If there is a match, the firewall forwards the server's certificate to the client
requesting server access and establishes a secure connection.
