Define Traffic to Decrypt (Strata Cloud Manager)

1. Log in to Strata Cloud Manager.
2. Add a new decryption policy rule.

   1. Select ConfigurationNGFW and Prisma AccessSecurity ServicesDecryption.
   2. In the Decryption Policies section, click Add Rule.
3. Provide basic information to identify the rule.

   1. Enter a descriptive Name.
   2. (Optional) Enter a Description of the rule.
   3. (Optional) Select a Position.
   4. (Optional) Select Tags.
4. Specify match criteria based on network and policy objects.

   A rule only applies to traffic that matches all specified criteria.

   • Configure the following Source and Destination settings to enforce traffic based on its origin or where it terminates:
     • Zones—Click Add Zones, then select existing Zones (for example, Internet), or click the down arrow and select Any Zone. You can also create a zone.
     • Addresses—Click Add Addresses, then select existing Addresses, or click the down arrow and select Any Address. You can also add Address Groups, External Dynamic Lists, and Regions, or (Destination section) SaaS Application Endpoints.
       To exclude Address objects from decryption:
       1. Specify at least one address, address group, external dynamic list, or region.
       2. Select Exclude (Negate).
     • Users—Click Add User Groups or Add Users, then select existing user groups or local users, or click Add Local User Groups or Add Local Users to create new user groups or users.
       You can also decrypt traffic for Any User or certain types of users: Match pre-logon (users who are connected to GlobalProtect but are not yet logged in), Match known-user, or Match unknown.
     • Devices—Click Add Device Profiles or (Source section) Add HIP Profiles, then select existing profiles or in the case of HIP Profiles, create a Host Information profile. You can also select Any or Match no-hip.
   • Configure Services and URLs settings to match traffic based on service (port and protocols) or URL categories:
     • Service Entities—Click Add Services or Add Service Groups, then either select existing services or service groups or click Create New to create a new entity.
       By default, decryption policy rules decrypt any traffic on TCP and UDP ports. However, you can click the down arrow and select Any Service, if necessary. To match applications on the default application ports, click the down arrow and select application-default.
       The application-default setting can be useful when you create a policy-based decryption exclusion. You can exclude applications running on their default ports from decryption, while continuing to decrypt the same applications if they are detected on nonstandard ports.
     • URL Category Entities—Click Add URL Categories, then select existing URL categories or click Create New. To apply the rule to any URL category, click the down arrow and select Any URL Category. You can also Add External Dynamic Lists and SaaS Application Endpoints. To create a new external dynamic list while configuring the rule, click Create New.
5. Specify how to handle traffic that matches rule conditions.

   1. In the Action and Advanced Inspection section, for Action, select either Decrypt or Do Not Decrypt.

      If you selected Decrypt, select a decryption Type:

      • SSL Forward Proxy.
      • SSL Inbound Inspection. Then, Add one or more Certificates for the internal server you want to protect. Decryption policy rules for SSL Inbound Inspection support a maximum of 12 certificates.
        You can decrypt SSL/TLS traffic bound for an internal server that hosts multiple domains, each domain with its own certificate. The NGFW negotiates SSL/TLS connections using the certificate in your policy rule that matches the one the server presents for the requested URL.
        To update certificates for protected internal servers without incurring downtime, renew or obtain a new server certificate before it expires or otherwise becomes invalid. Then, import the certificate and private key onto your NGFW or Strata Cloud Manager, add it to an SSL Inbound Inspection policy rule before installing the same certificate onto your web server. Updating your policy rule with a new certificate while another is active on your web server prepares the NGFW to decrypt traffic to the server regardless of the certificate in use. Configure SSL Inbound Inspection describes this process further.

      If you selected Do Not Decrypt, you can optionally Enforce TLS and Certificate Validation.
   2. (Optional) Associate a decryption profile with the decryption policy rule to block and control various aspects of traffic governed by the decryption policy rule.

      1. Create or modify a decryption profile.
      2. Under Action and Advanced Inspection, select a Decryption Profile.

      For SSL decryption, you can define the TLS protocol versions, key exchange algorithms, encryption algorithms, and authentication algorithms allowed for SSL Forward Proxy and SSL Inbound Inspection connections. You can also block sessions with weak protocol versions, expired certificates, and other options.

      The profile settings the NGFW applies to matching traffic depends on the policy rule action (Decrypt or Do Not Decrypt) and decryption type (SSL Forward Proxy and SSL Inbound Inspection). This allows you to use the different decryption profiles with different decryption policy rules that apply to different types of traffic and users.
6. Configure decryption logging.

   You can log successful and unsuccessful TLS handshakes and configure external log forwarding.
7. Save the decryption policy rule.
8. Click Push Config to begin enforcing the rule.
9. Test your decryption configuration, and make any necessary adjustments.
10. Choose your next step:

    • Configure SSL Forward Proxy.
    • Configure SSL Inbound Inspection.
    • Create policy-based decryption exclusions for traffic you choose not to decrypt.
    • Add sites that break decryption for technical reasons such as pinned certificates or mutual authentication to the SSL decryption exclusion list.