Configure SSL Inbound Inspection
Focus
Focus

Configure SSL Inbound Inspection

Table of Contents

Configure SSL Inbound Inspection

Decrypt and inspect inbound SSL/TLS traffic for potential threats and apply security protections against those threats.
Configure SSL Inbound Inspection to decrypt and inspect SSL/TLS traffic destined for internal network servers. SSL Inbound Inspection provides visibility into network activity, which enables effective monitoring and handling of traffic that may be risky but is not outright blocked. To enable SSL Inbound Inspection, install the server certificate and private key of each network server you want to protect, and create a Decryption policy rule for SSL Inbound Inspection.
For enhanced security, apply a Decryption profile that blocks sessions with insecure protocol versions and cipher sites to the policy rule. The firewall enforces the actions specified in the Decryption profile and other profiles applied to the policy rule, including Antivirus, Vulnerability Protection, Anti-Spyware, URL Filtering, and File Blocking profiles.
As a best practice, enable the firewall to forward decrypted SSL traffic to the Advanced WildFire cloud for analysis and signature generation.
When you configure SSL Inbound Inspection, the proxied traffic does not support DSCP code points or QoS.
SSL Inbound Inspection does not support Authentication Portal redirect. To use Authentication Portal redirect and decryption, configure SSL Forward Proxy.
  1. Verify that the appropriate interfaces are configured as either virtual wire, Layer 2, or Layer 3 interfaces.
    You can't use a tap mode interface for SSL Inbound Inspection.
    To view the configured interfaces, select
    Network
    Interfaces
    Ethernet
    . You can select an interface to modify its configuration, including the interface type.
  2. Verify that the targeted server certificate has been installed on the firewall.
    To view installed certificates, log in to the firewall and select
    Device
    Certificate Management
    Certificates
    Device Certificates
    .
    The TLS versions that your web server supports determine how you should install the server certificate and key on the firewall. We recommend uploading a certificate chain (a single file) to the firewall if your end-entity (leaf) certificate is signed by one or more intermediate certificates
    and
    your web server supports TLS 1.2 and either RSA or PFS key exchange algorithms. Uploading the chain avoids client-side server certificate authentication issues.
    Arrange the certificates in the file as follows:
    1. End-entity (leaf) certificate
    2. Intermediate certificates (in issuing order)
    3. (
      Optional
      ) Root certificate
    You can upload the server certificate and private key alone to the firewall when the leaf certificate is signed by intermediate certificates if your web server supports TLS 1.3 connections and the certificate chain is installed on the server. SSL Inbound Inspection discusses each case in more detail.
    To import the targeted server certificate onto the firewall:
    1. Select
      Device
      Certificate Management
      Device Certificates
      , and then
      Import
      a certificate.
    2. Enter a descriptive
      Certificate Name
      .
    3. Browse for and select the targeted server
      Certificate File
      .
    4. Click
      OK
      to save your changes.
  3. Create a Decryption policy rule to define the traffic that the firewall decrypts.
    1. Select
      Policies
      Decryption
      , and then
      Add
      a new rule or modify an existing rule.
    2. Select
      Options
      and configure the following:
      • For
        Action
        , select
        Decrypt
        .
      • For
        Type
        , select
        SSL Inbound Inspection
        .
      • Add
        up to twelve
        Certificates
        for the internal server you want to protect.
        Support for multiple certificates enables you to update server certificates without creating downtime and to create a policy rule for an internal server that hosts various domains, where each domain has its own certificate.
        To update a certificate for a protected internal server without incurring downtime, follow these steps:
        1. Renew or obtain a new server certificate before the current one expires or otherwise becomes invalid.
        2. Import the new certificate and private key onto your firewall.
        3. Add the new certificate to your SSL Inbound Inspection policy rule.
          This must be done while a different certificate is active on the web server, so that a valid certificate in the policy rule always matches the certificate presented by the server.
        4. Install the new certificate on your web server, and then verify that it was properly installed.
        Installation of the new certificate does not impact existing connections. The firewall verifies that the certificate in the Server Hello message matches the certificate in your decryption policy rule. If there isn't a match, the session ends, and the corresponding Decryption log entry reports the session-end reason as a certificate mismatch between the firewall and server. To view the server certificates used in all inbound inspection sessions, select
        Log Successful SSL Handshake
        under Log Settings (
        Policies
        Decryption
        Options
        ).
        (
        Panorama
        ) Support for multiple certificates in SSL Inbound Inspection policy rules isn't available on PAN-OS versions earlier than PAN-OS 10.2. If you push an SSL Inbound Inspection policy rule with multiple certificates from a Panorama management server running PAN-OS 11.0 to a firewall running older software, the policy rule on the managed firewall inherits only the first certificate from the alphabetically sorted list of certificates.
        Before pushing your decryption policy rule from Panorama, we recommend setting up different templates or device groups for firewalls running PAN-OS 10.1 and earlier to ensure you push the correct policy rule and certificate to the appropriate firewalls.
      • (
        Best Practice
        ) Select or create a that blocks insecure protocol versions and cipher suites.
        To create a best practice decryption profile for SSL Inbound Inspection, configure the options described in SSL Inbound Inspection Decryption Profile.
        Create separate profiles for servers with different security capabilities. For example, if a group of servers supports only RSA, in the SSL Protocol Settings of the Decryption profile, select only RSA for the key exchange algorithm. Likewise, for servers that support PFS, set the SSL Protocol Setting to only support PFS.
        Configure the SSL Protocol Settings for the highest level of security that the server supports, but check performance to ensure that the firewall can handle the higher processing load that higher security protocols and algorithms require.
    3. Click
      OK
      to save your changes.
  4. Commit
    your changes.
  5. Choose your next step:

Recommended For You