Apply Granular Settings to Traffic Matching a Decryption Policy Rule (Strata Cloud Manager)

Apply Granular Settings to Traffic Matching a Decryption Policy Rule (Strata Cloud Manager)

1. Create a decryption profile.

   Select Manage Configuration Security Services Decryption. Under Decryption Profiles, click Add Profile.
2. Enter a descriptive Name for the profile.
3. Configure Handshake Settings.

   1. Select a Protocol Min Version: SSLv3.0, TLSv1.0 through TLSv1.3.
   2. Select a Protocol Max Version: SSLv3.0, TLSv1.0 through TLSv1.3, and Max.
   3. Add or Remove Key Exchange Algorithms.

      To remove an algorithm, select the algorithm and then click Remove.
   4. Add or Remove Encryption Algorithms.
   5. Add or Remove Authentication Algorithms.
4. (Optional) Configure settings to verify certificates, enforce protocol versions and cipher suites, and perform failure checks on SSL Forward Proxy traffic.

   If the NGFW is in FIPS-CC mode and managed by a Panorama™ management server in standard mode, a decryption profile must be created locally on the NGFW. Decryption profiles created on Panorama in standard mode contain references to 3DES and RC4 encryption algorithms and MD5 authentication algorithm that are not supported and cause pushes to the managed NGFW to fail.

   1. For Server Certificate Verification, select Block sessions with expired certificates or Block sessions with untrusted issuer
   2. For Unsupported Mode Checks, select Block sessions with unsupported version or Block sessions with unsupported cipher suite.
   3. To configure Advanced SSL Forward Proxy Settings, select Advanced.

      For Server Certificate Verification, you can Block sessions with unknown certificate status, Block sessions on certificate status check timeout. Restrict certificate extensions, or Append certificate's CN value to SAN extension.

      For Unsupported Mode Checks, you can Block sessions with client authentication.

      For Failure Checks, you can Block downgrade on no resource.

      For Client Extension, you can Strip ALPN.
   4. Save the settings.
5. (Optional) Configure Unsupported Mode and Failure Checks for SSL Inbound Inspection.

   1. For Unsupported Mode Checks, select Block sessions with unsupported version or Block sessions with unsupported cipher suite.
   2. For Failure Checks, select Block sessions if resources not available or Block sessions if HSM not available.
6. (Optional) Configure Server Certificate Verification settings for traffic that you choose not to decrypt.

   These settings are active only when the decryption profile is attached to a decryption policy rule that disables decryption for certain traffic.

   Select Block sessions with expired certificates or Block sessions with untrusted issuers to validate certificates for traffic excluded from decryption.

   Create policy-based exclusions only for traffic that you choose not to decrypt. If a server breaks decryption for technical reasons, add the server to the Global Decryption Exclusion list instead.
7. Save the profile.
8. Push Config.