Configure SSL Forward Proxy

Ensure that the appropriate interfaces are configured as either virtual wire, Layer 2, or Layer 3 interfaces.
View configured interfaces on the
Network
Interfaces
Ethernet
tab. The
Interface Type
column displays if an interface is configured to be a
Virtual Wire
or
Layer 2
, or
Layer 3
interface. You can select an interface to modify its configuration, including what type of interface it is.
Configure the forward trust certificate for the firewall to present to clients when the server certificate is signed by a trusted CA:
(Recommended)
Use an enterprise CA-signed certificate as the forward trust certificate.
Generate a Certificate Signing Request (CSR) for the enterprise CA to sign and validate:
Select
Device
Certificate Management
Certificates
and click
Generate
.
Enter a
Certificate Name
, such as my-fwd-proxy.
In the
Signed By
drop-down, select
External Authority (CSR)
.
(Optional)
If your enterprise CA requires it, add
Certificate Attributes
to further identify the firewall details, such as Country or Department.
Click
OK
to save the CSR. The pending certificate is now displayed on the
Device Certificates
tab.
Export the CSR:
Select the pending certificate displayed on the
Device Certificates
tab.
Click
Export
to download and save the certificate file.
Leave
Export private key
unselected in order to ensure that the private key remains securely on the firewall.
Click
OK
.
Provide the certificate file to your enterprise CA. When you receive the enterprise CA-signed certificate from your enterprise CA, save the enterprise CA-signed certificate for import onto the firewall.
Import the enterprise CA-signed certificate onto the firewall:
Select
Device
Certificate Management
Certificates
and click
Import
.
Enter the pending
Certificate Name
exactly (in this case, my-fwd-trust). The
Certificate Name
that you enter must exactly match the pending certificate name in order for the pending certificate to be validated.
Select the signed
Certificate File
that you received from your enterprise CA.
Click
OK
. The certificate is displayed as valid with the Key and CA check boxes selected.
Select the validated certificate, in this case, my-fwd-proxy, to enable it as a
Forward Trust Certificate
to be used for SSL Forward Proxy decryption.
Click
OK
to save the enterprise CA-signed forward trust certificate.
Use a self-signed certificate as the forward trust certificate.
Generate a new certificate:
Select
Device
Certificate Management
Certificates
.
Click
Generate
at the bottom of the window.
Enter a
Certificate Name
, such as
my-fwd-trust
.
Enter a
Common Name
, such as 192.168.2.1. This should be the IP or FQDN that will appear in the certificate. In this case, we are using the IP of the trust interface. Avoid using spaces in this field.
Leave the
Signed By
field blank.
Click the
Certificate Authority
check box to enable the firewall to issue the certificate. Selecting this check box creates a certificate authority (CA) on the firewall that is imported to the client browsers, so clients trust the firewall as a CA.
Generate
the certificate.
Click the new certificate
my-fwd-trust
to modify it and enable the certificate to be a
Forward Trust Certificate
.
Click
OK
to save the self-signed forward trust certificate.
Distribute the forward trust certificate to client system certificate stores.
If you do not install the forward trust certificate on client systems, users will see certificate warnings for each SSL site they visit.
If you are using an enterprise-CA signed certificate as the forward trust certificate for SSL Forward Proxy decryption, and the client systems already have the enterprise CA added to the local trusted root CA list, you can skip this step.
On a firewall configured as a GlobalProtect portal:
This option is supported with Windows and Mac client OS versions, and requires GlobalProtect agent 3.0.0 or later to be installed on the client systems.
Select
Network
GlobalProtect
Portals
and then select an existing portal configuration or
Add
a new one.
Select
Agent
and then select an existing agent configuration or
Add
a new one.
Add
the SSL Forward Proxy forward trust certificate to the Trusted Root CA section.
Install in Local Root Certificate Store
so that the GlobalProtect portal automatically distributes the certificate and installs it in the certificate store on GlobalProtect client systems.
Click
OK
twice.
Without GlobalProtect:
Export the forward trust certificate for import into client systems by highlighting the certificate and clicking
Export
at the bottom of the window. Choose PEM format, and do not select the
Export private key
option. import it into the browser trusted root CA list on the client systems in order for the clients to trust it. When importing to the client browser, ensure the certificate is added to the Trusted Root Certification Authorities certificate store. On Windows systems, the default import location is the Personal certificate store. You can also simplify this process by using a centralized deployment, such as an Active Directory Group Policy Object (GPO).
Configure the forward untrust certificate.
Click
Generate
at the bottom of the certificates page.
Enter a
Certificate Name
, such as my-fwd-untrust.
Set the
Common Name
, for example 192.168.2.1. Leave
Signed By
blank.
Click the
Certificate Authority
check box to enable the firewall to issue the certificate.
Click
Generate
to generate the certificate.
Click
OK
to save.
Click the new my-ssl-fw-untrust certificate to modify it and enable the
Forward Untrust Certificate
option.
Do not export the forward untrust certificate for import into client systems. If the forward untrust certificate is imported on client systems, the users will not see certificate warnings for SSL sites with untrusted certificates.
Click
OK
to save.
(Optional)
Set the key size of the SSL Forward Proxy certificates that the firewall presents to clients. By default, the firewall determines the key size to use based on the key size of the destination server certificate.
Configure the Key Size for SSL Forward Proxy Server Certificates.
Create a Decryption Policy Rule to define traffic for the firewall to decrypt.
Select
Policies
Decryption
, Add or modify an existing rule, and define traffic to be decrypted.
Select
Options
and:
Set the rule
Action
to
Decrypt
matching traffic.
Set the rule
Type
to
SSL Forward Proxy
.
(Optional)
Select a
Decryption Profile
to block and control various aspects of the decrypted traffic (for example, Create a Decryption Profile to perform certificate checks and enforce strong cipher suites and protocol versions).
Click
OK
to save.
Enable the firewall to forward decrypted SSL traffic for WildFire analysis.
This option requires an active WildFire license and is a WildFire best practice.
Commit
the configuration.
Choose your next step...
Enable Users to Opt Out of SSL Decryption.
Configure Decryption Exceptions to disable decryption for certain types of traffic.