Configure SSL Inbound Inspection (PAN-OS & Panorama)

1. Verify that the appropriate interfaces are configured as either virtual wire, Layer 2, or Layer 3 interfaces.

   You can't use a tap mode interface for SSL Inbound Inspection.

   To view the configured interfaces, select NetworkInterfacesEthernet. You can select an interface to modify its configuration, including the interface type.
2. Verify installation of the certificate for the destination server.

   To view installed certificates, log in to the NGFW, Prisma Access, or a management interface, select DeviceCertificate ManagementCertificatesDevice Certificates.

   The TLS versions that your web server supports determine how you should install the server certificate and key. We recommend uploading a certificate chain (a single file) if your end-entity (leaf) certificate is signed by one or more intermediate certificates and your web server supports TLSv1.2 and either RSA or PFS key exchange algorithms. Uploading the chain avoids client-side server certificate authentication issues.

   Arrange the certificates in the file as follows:

   1. End-entity (leaf) certificate
   2. Intermediate certificates (in issuing order)
   3. (Optional) Root certificate

   You can upload the server certificate and private key alone when the leaf certificate is signed by intermediate certificates, if your web server supports TLSv1.3 connections and the certificate chain has been installed on the server. SSL Inbound Inspection discusses each case in detail.

   To import the targeted server certificate onto the NGFW:

   1. Select DeviceCertificate ManagementDevice Certificates, and then Import a certificate.
   2. Enter a descriptive Certificate Name.
   3. Browse for and select the Certificate File.
   4. Click OK to save your changes.
3. Create a decryption policy rule to define the traffic that the firewall decrypts.

   1. Select PoliciesDecryption, and then Add a new rule or modify an existing rule.
   2. Select Options and configure the following:

      • For Action, select Decrypt.
      • For Type, select SSL Inbound Inspection.
      • Add up to 12 Certificates for the internal server you want to protect.
        To update the certificate for a protected internal server without incurring downtime, follow these steps:

        1. Renew or obtain a new server certificate before the current one expires or otherwise becomes invalid.
        2. Import the new certificate and private key onto your NGFW.
        3. Add the new certificate to your SSL Inbound Inspection decryption policy rule.
           This must be done while a different certificate is active on the web server, so that a valid certificate in the policy rule always matches the certificate presented by the server.
        4. Install the new certificate on your web server, and then verify that it was properly installed.

        Installation of the new certificate doesn't impact existing connections. The NGFW verifies that the certificate in the Server Hello message matches the certificate in your decryption policy rule. If there isn't a match, the session ends, and the corresponding decryption log entry reports the session-end reason as a certificate mismatch between the firewall and server. To view the server certificates used in all inbound inspection sessions, select Log Successful SSL Handshake under Log Settings (PoliciesDecryptionOptions).

        (Panorama ^™) Support for multiple certificates in SSL Inbound Inspection policy rules isn't available on PAN-OS versions earlier than PAN-OS 10.2. If you push an SSL Inbound Inspection policy rule with multiple certificates from a Panorama management server running PAN-OS 11.1 to an NGFW running older software, the policy rule on the managed NGFW inherits only the first certificate from the alphabetically sorted list of certificates.

        Before pushing your decryption policy rule from Panorama, we recommend setting up different templates or device groups for NGFWs running PAN-OS 10.1 and earlier to ensure you push the correct policy rule and certificate to the appropriate NGFWs.
      • (Best Practice) Select or create a that blocks insecure protocol versions and cipher suites.
        To create a best practice decryption profile for SSL Inbound Inspection, configure the options described in SSL Inbound Inspection Decryption Profile.
        Create separate profiles for servers with different security capabilities. For example, if a group of servers supports only RSA, in the SSL Protocol Settings of the decryption profile, select only RSA for the key exchange algorithm. Likewise, for servers that support only PFS, set the SSL Protocol Settings to only support PFS.

        Configure the SSL Protocol Settings for the highest level of security that the server supports, but check performance to ensure that the NGFW can handle the higher processing load that higher security protocols and algorithms require.
   3. Click OK to save your changes.
4. (Advanced WildFire subscriptions only) Forward decrypted SSL traffic to the Advanced WildFire cloud for analysis.
5. Commit your changes.
6. (PAN-OS 11.2, HSM deployments only) Activate TLSv1.3 support for HSM integration with SSL Inbound Inspection.

   Use the set ssl inbound-inspection tls1.3-with-hsm enable yes CLI command.
7. Choose your next step:

   • Enable users to opt out of SSL decryption.
   • Configure decryption exclusions for traffic that you don’t want to decrypt.