Strata Cloud Manager

1. Select ManageConfigurationNGFW and Prisma Access.
2. From the Configuration Scope dropdown, select the folder or NGFW for which you want to configure inbound decryption.
3. Select Security ServicesSecurity Policy.
4. Click Add Rule to create a new security rule for decryption.
5. Provide the following details under General.

   • Name—Name of the rule.
   • Description—A description for the rule.
   • Priority—A unique priority for the rule.
   • Enabled—Enable the field to associate the configuration with the rule. This field is enabled by default.
6. Define matching criteria for the Source and Destination IP address fields.
7. Configure Granular Controls.

   • Specify the Application Match Criteria you want the rule to allow or block.
     You can create TLS decryption rules with Applications—Any or SSL—Match only.
   • Specify a URL category as the match criteria for the rule.
   • Specify the Protocol and Ports you want the rule to allow or block.
   • Allow—Allow traffic.
   • Drop—Block traffic and enforce the default drop action defined for the application being denied.
   • Reset Server—Sends the TCP reset to the server-side device.
   • Reset Both—Sends a TCP reset to both client and server-side devices.
8. Under TLS Decryption, select Inbound and select an Inbound Inspection Certificate from the Cloud Certificates dropdown.

   • Add a certificate if you have not done so already.
   • PKCS8 is the supported certificate format.
   • Inbound decryption supports self-signed and root CA signed certificates and does not support chained certificates.
   • The decryption profile for TLS decryption is set to best practice Security policy. See decrypt traffic for full visibility and threat inspection for more information.
9. Select Logging to enable logging.
10. Click Save.
11. Click Push Config to deploy the configuration to the firewall.