topic Re: Decryption in General Topics

Decryption

jorge — Thu, 07 Jun 2012 19:49:53 GMT

Does the PAN still inspect secured traffic for all threats if it's not decrypting it?

Re: Decryption

mikand — Thu, 07 Jun 2012 20:35:22 GMT

You mean if a particular threat item isnt evaluated because the traffic happens to be ssl or ssh or similar?

I guess this would be true in order to lower number of false positivies.

On the other hand there are many threats where it doesnt matter if the payload is encrypted or not.

Re: Decryption

essnet — Tue, 12 Jun 2012 13:03:02 GMT

Hello,

If you can't decrypt, you can't do anvivirus and such , traffic will be seen as SSL application, so there not much to do ....

Re: Decryption

mikand — Wed, 13 Jun 2012 06:29:17 GMT

However the IPS will still function but of course not be able to inspect the content of the payload but be able to inspect the payload itself (for example if you have an IPS rule that says generate alert if SSLv1 handshake is seen or such).

Re: Decryption

HartkentlyNua — Mon, 01 Oct 2012 05:23:37 GMT

Hi guys.

thank you guys for the information. I'm now working on the ssl decryption.

:smileygrin:

Re: Decryption

ppatel — Mon, 01 Oct 2012 06:45:05 GMT

Hello,

Just to add, say for example To block facebook by application in a rule , SSL decryption needs to be configured on the PAN, so that the PAN can proxy the outbound SSL sessions and get visibility into the traffic enabling it to identify the application correctly as 'facebook' and enforce app-ID based rules.

Hence, without SSL decryption the app-id in traffic logs will appear as 'ssl' for the facebook session. Once SSL decryption is configured, the app-id in monitor logs should show as 'facebook'.

A technote on how to configure SSL decryption can be found at :
https://live.paloaltonetworks.com/docs/DOC-1412

Let me know if that helps.

Regards

Parth

Re: Decryption

mikand — Mon, 01 Oct 2012 19:45:20 GMT

Didnt some appid's look in the CN part of the certs being used (or was it the url-filtering that did this?) so the PA could somewhat inspect ssl traffic even if there is no ssl termination (decryption) setup?

Re: Decryption

jvalentine — Mon, 01 Oct 2012 20:27:02 GMT

I think it varies by app-id signature. I've created a custom app-id that looks at the cn part of the cert. If a match is present, then the application is called "my custom app" instead of SSL. At that point, I can create a security rule that blocks "my custom app" while still permitting SSL.