topic Re: Deep Packet Inspection and SSL Certificate in General Topics

Deep Packet Inspection and SSL Certificate

N.MANTUA — Thu, 26 Dec 2024 13:33:13 GMT

Hello, newbie here. One of our clients asked me:

"We have an exchange server which is on site. We need to renew the ssl certificate, I was told that if the Palo Alto firewall performs deep packet inspection, we need to supply the ssl certificate to the firewall.

if it is so, we need to coordinate with my local admin to install the ssl certificate on the server and you will need to do your setup on the firewall, we need to plan a meeting..."

As I read the SSL Inbound Inspection document, the client is right.

May I know the thoughts of those who actually configured a Deep Packet Inspection on their Palo Alto firewall?

Thanks

Re: Deep Packet Inspection and SSL Certificate

OtakarKlier — Fri, 27 Dec 2024 18:18:10 GMT

Hello,

I would first check to see if its enabled for that traffic. Go to Policies on the Top menu then Decryption on the Left Menu. Check here to see if inbound inspection is enabled. It would be something like Source Zone Untrust, Destination zone Trust. Could also be listed by IP address or Object name of the Exchange server.

Hope this helps.

Re: Deep Packet Inspection and SSL Certificate

PavelK — Mon, 06 Jan 2025 00:54:55 GMT

Hello @N.MANTUA

yes, this is correct understanding. Once Exchange server administrator renews certificate you will have to export that certificate from server and import it to Firewall to ensure inbound decryption works after server certificate renewal.

Here is video tutorial for setup of inbound SSL decryption: Video Tutorial: How to Configure SSL Inbound Inspection on the Palo Alto Networks Firewall.

After you have certificate imported in Firewall you can easily replace certificate by selecting it from drop down list under: Options > Certificate. Alternatively if you can have certificate in advance you can pre-prepare by cloning existing decryption policy and use new certificate, then you can position the policy below existing one and flip the order after server admin renews certificate.

Kind Regards

Pavel

Re: Deep Packet Inspection and SSL Certificate

N.MANTUA — Mon, 06 Jan 2025 17:36:39 GMT

Thanks a lot!

Re: Deep Packet Inspection and SSL Certificate

N.MANTUA — Mon, 06 Jan 2025 17:40:39 GMT

Thanks for the advice. That's a good place to check.