Learn how to set up outbound decryption on Cloud NGFW for Azure.
| Where Can I Use This? | What Do I Need? |
|---|
|
|
- Cloud NGFW subscription
- Palo Alto Networks Customer Support Portal account
- Azure Marketplace subscription
|
With Outbound decryption, Cloud NGFW behaves like an
SSL Forward Proxy, and uses its associated
certificates to establish itself as a trusted third party (meddler in the middle
(MitM)) for the client-server session. However, Cloud NGFW keeps your traffic packet
headers and payload intact, providing complete visibility of the source's identity
to your destinations.
Outbound decryption uses two certificate objects - Trust and Untrust. The NGFW
presents the trust certificate to clients during SSL decryption if the client is
attempting to connect to a server that has a certificate signed by a trusted
certificate authority (CA). Alternatively, the NGFW presents the untrust certificate
to the client attempting to connect to a server that has a certificate signed by a
CA that the NGFW does not trust.
You can configure the NGFW resource to decrypt the SSL traffic leaving your VNet or
subnet. You can then enforce App-ID and security settings on the plaintext traffic,
including Antivirus, Vulnerability, antispyware, URL Filtering, and file blocking
profiles. After decrypting and inspecting traffic, the firewall reencrypts the
plaintext traffic as it exits the firewall to ensure privacy and security.
This procedure only defines the certificates that the firewall uses for Outbound TLS
decryption. Enable Outbound TLS decryption during rules creation.
Strata Cloud Manager
Set up outbound decryption on Cloud NGFW for Azure using Strata Cloud Manager.
Select .
From the
Configuration Scope dropdown, select the
folder or NGFW for which you want to configure outbound decryption.
Select .
For
Untrust Certificate, select a Cloud Certificate
from the dropdown.
If you select an expired certificate,
the configuration push succeeds but the firewall generates a warning.
Strata Cloud Manager does not display this warning.
For
Trust Certificate, select a Cloud Certificate
from the dropdown.
The certificate and private key are stored in the Azure Key Vault, and
the workload uses this information to decrypt the traffic.
The certificate must be a CA certificate. Set the CA value in the Basic
Constraints to TRUE.
PFX and PEM are the supported
certificate formats.
Trust certificates can't be
self-signed, but the untrust certificate can be self-signed or
CA-signed.
Click
Save.
Verify that the managed identity assigned to the NGFW has the
Key Vault Secrets User role configured in
.
Local Rulestack
Set up outbound decryption on Cloud NGFW for Azure using a local rulestack.
Use PAN-OS version 11.0.x when using Azure Key Vault
for outbound decryption.
Select
Rulestacks and select a previously created
rulestack to apply the certificate.
Select .
Select a certificate.
- Select an Untrust Certificate.
- Select a Trust Certificate.
The certificate and private key are stored in the Azure Key Vault, and the
workload uses this information to decrypt the traffic.
The certificate must be a CA certificate. Set the CA value in the Basic
Constraints to TRUE. The following is an example private CA certificate.
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 4121 (0x1019)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, ST=Washington, L=Seattle, O=Example Company Root CA, OU=Corp, CN=www.example.com/emailAddress=corp@www.example.com
Validity
Not Before: Feb 26 20:27:56 2018 GMT
Not After : Feb 24 20:27:56 2028 GMT
Subject: C=US, ST=WA, L=Seattle, O=Examples Company Subordinate CA, OU=Corporate Office, CN=www.example.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:c0: ... a3:4a:51
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
F8:84:EE:37:21:F2:5E:0B:6C:40:C2:9D:C6:FE:7E:49:53:67:34:D9
X509v3 Authority Key Identifier:
keyid:0D:CE:76:F2:E3:3B:93:2D:36:05:41:41:16:36:C8:82:BC:CB:F8:A0
X509v3 Basic Constraints: critical
CA:TRUE
X509v3 Key Usage: critical
Digital Signature, CRL Sign
Signature Algorithm: sha256WithRSAEncryption
6:bb:94: ... 80:d8
If you're using an End-Entity certificate for decrypting traffic, only the
End Entity Cert with public and private key is stored in the Azure Key
Vault.
PKCS8 is the supported certificate format.
Trust certificates can't be self-signed, but the
untrust certificate can be self-signed or CA-signed.
Navigate to the previously created
Rulestack and go to the
Managed
Identity page.
From the
Enable MI dropdown menu, select the managed identity that was
associated with the key vault.
Click Save.
