End-of-Life (EoL)
Configure SSL Forward Proxy
To enable the firewall to perform SSL Forward Proxy decryption,
you must set up the certificates required to establish the firewall
as a trusted third party to the session between the client and the
server. The firewall can use self-signed certificates or certificates
signed by an enterprise certificate authority (CA) as
forward
trust certificates
to authenticate the SSL session with the
client. - (Recommended)Enterprise CA-signed CertificatesAn enterprise CA can issue a signing certificate which the firewall can use to sign the certificates for sites requiring SSL decryption. When the firewall trusts the CA that signed the certificate of the destination server, the firewall can then send a copy of the destination server certificate to the client signed by the enterprise CA.
- Self-signed CertificatesWhen a client connects to a server with a certificate that is signed by a CA that the firewall trusts, the firewall can sign a copy of the server certificate to present to the client and establish the SSL session. You can use self-signed certificates for SSL Forward Proxy decryption if your organization does not have an enterprise CA or if you intend to only perform decryption for a limited number of clients.
Additionally,
set up a
forward untrust
certificate
for
the firewall to present to clients when the server certificate is
signed by a CA that the firewall does not trust. This ensures that
clients are prompted with a certificate warning when attempting
to access sites with untrusted certificates.After setting
up the forward trust and forward untrust certificates required for
SSL Forward Proxy decryption, add a decryption policy rule to define
the traffic you want the firewall to decrypt. SSL tunneled traffic
matched to the decryption policy rule is decrypted to clear text
traffic. The clear text traffic is blocked and restricted based
on the decryption profile attached to the policy and the firewall
security policy. Traffic is re-encrypted as it exits the firewall.
- Ensure that the appropriate interfaces are configured as either virtual wire, Layer 2, or Layer 3 interfaces.View configured interfaces on thetab. TheNetworkInterfacesEthernetInterface Typecolumn displays if an interface is configured to be aVirtual WireorLayer 2, orLayer 3interface. You can select an interface to modify its configuration, including what type of interface it is.
- Configure the forward trust certificate for the firewall to present to clients when the server certificate is signed by a trusted CA:(Recommended)Use an enterprise CA-signed certificate as the forward trust certificate.
- Generate a Certificate Signing Request (CSR) for the enterprise CA to sign and validate:
- Selectand clickDeviceCertificate ManagementCertificatesGenerate.
- Enter aCertificate Name, such as my-fwd-proxy.
- In theSigned Bydrop-down, selectExternal Authority (CSR).
- (Optional)If your enterprise CA requires it, addCertificate Attributesto further identify the firewall details, such as Country or Department.
- ClickOKto save the CSR. The pending certificate is now displayed on theDevice Certificatestab.
- Export the CSR:
- Select the pending certificate displayed on theDevice Certificatestab.
- ClickExportto download and save the certificate file.LeaveExport private keyunselected in order to ensure that the private key remains securely on the firewall.
- ClickOK.
- Provide the certificate file to your enterprise CA. When you receive the enterprise CA-signed certificate from your enterprise CA, save the enterprise CA-signed certificate for import onto the firewall.
- Import the enterprise CA-signed certificate onto the firewall:
- Selectand clickDeviceCertificate ManagementCertificatesImport.
- Enter the pendingCertificate Nameexactly (in this case, my-fwd-trust). TheCertificate Namethat you enter must exactly match the pending certificate name in order for the pending certificate to be validated.
- Select the signedCertificate Filethat you received from your enterprise CA.
- ClickOK. The certificate is displayed as valid with the Key and CA check boxes selected.
- Select the validated certificate, in this case, my-fwd-proxy, to enable it as aForward Trust Certificateto be used for SSL Forward Proxy decryption.
- ClickOKto save the enterprise CA-signed forward trust certificate.
Use a self-signed certificate as the forward trust certificate.- Generate a new certificate:
- Select.DeviceCertificate ManagementCertificates
- ClickGenerateat the bottom of the window.
- Enter aCertificate Name, such asmy-fwd-trust.
- Enter aCommon Name, such as 192.168.2.1. This should be the IP or FQDN that will appear in the certificate. In this case, we are using the IP of the trust interface. Avoid using spaces in this field.
- Leave theSigned Byfield blank.
- Click theCertificate Authoritycheck box to enable the firewall to issue the certificate. Selecting this check box creates a certificate authority (CA) on the firewall that is imported to the client browsers, so clients trust the firewall as a CA.
- Generatethe certificate.
- Click the new certificatemy-fwd-trustto modify it and enable the certificate to be aForward Trust Certificate.
- ClickOKto save the self-signed forward trust certificate.
- Distribute the forward trust certificate to client system certificate stores.If you do not install the forward trust certificate on client systems, users will see certificate warnings for each SSL site they visit.If you are using an enterprise-CA signed certificate as the forward trust certificate for SSL Forward Proxy decryption, and the client systems already have the enterprise CA added to the local trusted root CA list, you can skip this step.On a firewall configured as a GlobalProtect portal:This option is supported with Windows and Mac client OS versions, and requires GlobalProtect agent 3.0.0 or later to be installed on the client systems.
- Selectand then select an existing portal configuration orNetworkGlobalProtectPortalsAdda new one.
- SelectAgentand then select an existing agent configuration orAdda new one.
- Addthe SSL Forward Proxy forward trust certificate to the Trusted Root CA section.
- Install in Local Root Certificate Storeso that the GlobalProtect portal automatically distributes the certificate and installs it in the certificate store on GlobalProtect client systems.
- ClickOKtwice.
Without GlobalProtect:Export the forward trust certificate for import into client systems by highlighting the certificate and clickingExportat the bottom of the window. Choose PEM format, and do not select theExport private keyoption. import it into the browser trusted root CA list on the client systems in order for the clients to trust it. When importing to the client browser, ensure the certificate is added to the Trusted Root Certification Authorities certificate store. On Windows systems, the default import location is the Personal certificate store. You can also simplify this process by using a centralized deployment, such as an Active Directory Group Policy Object (GPO). - Configure the forward untrust certificate.
- ClickGenerateat the bottom of the certificates page.
- Enter aCertificate Name, such as my-fwd-untrust.
- Set theCommon Name, for example 192.168.2.1. LeaveSigned Byblank.
- Click theCertificate Authoritycheck box to enable the firewall to issue the certificate.
- ClickGenerateto generate the certificate.
- ClickOKto save.
- Click the new my-ssl-fw-untrust certificate to modify it and enable theForward Untrust Certificateoption.Do not export the forward untrust certificate for import into client systems. If the forward untrust certificate is imported on client systems, the users will not see certificate warnings for SSL sites with untrusted certificates.
- ClickOKto save.
- (Optional)Set the key size of the SSL Forward Proxy certificates that the firewall presents to clients. By default, the firewall determines the key size to use based on the key size of the destination server certificate.
- Create a Decryption Policy Rule to define traffic for the firewall to decrypt.
- Select, Add or modify an existing rule, and define traffic to be decrypted.PoliciesDecryption
- SelectOptionsand:
- Set the ruleActiontoDecryptmatching traffic.
- Set the ruleTypetoSSL Forward Proxy.
- (Optional)Select aDecryption Profileto block and control various aspects of the decrypted traffic (for example, Create a Decryption Profile to perform certificate checks and enforce strong cipher suites and protocol versions).
- ClickOKto save.
- Enable the firewall to forward decrypted SSL traffic for WildFire analysis.This option requires an active WildFire license and is a WildFire best practice.
- Committhe configuration.
- Choose your next step...
- Configure Decryption Exceptions to disable decryption for certain types of traffic.
Recommended For You
Recommended Videos
Recommended videos not found.