topic How to protect an https webserver in the dmz with vulnerability protection ? in General Topics

How to protect an https webserver in the dmz with vulnerability protection ?

cfpa — Thu, 24 May 2012 14:25:22 GMT

Hi guys,

the vulnerability protection is a really nice feature of the PA.If the PA is able to take a look at the traffic

this should work fine.

But how does it work if the webserver in the dmz only accepts https connections ? So the possible attacker connects with https to the webserver.

I guess i need to terminate the ssl tunnel at the pa to be able to use the vulnerability protection in this case ?

Many thanks,

Christian

Re: How to protect an https webserver in the dmz with vulnerability protection ?

mikand — Thu, 24 May 2012 18:50:34 GMT

Yes, you need to enable SSL termination in your PA device in order to inspect the encrypted https traffic.

SSL termination can work in (currently) two modes:

SSL-proxy or SSL-intercept (if I remember correctly).

SSL-proxy is mostly used when you have a bunch of clients you wish to protect (like against bad things at Internet). The clients will then have the cert the PA will use for termination as a trusted CA and accept that the https is made up by the PA instead of the real server.

SSL-proxy will setup one SSL session from PA to destination and one SSL from PA to client.

SSL-intercept is mostly used when you have one (or more) servers which you wish to protect against (for example) bad things from Internet. In this case you have the private key of the server and can import this to your PA device.

SSL-intercept will then be able to sniff the traffic but the client will have its session directly with the server.

Re: How to protect an https webserver in the dmz with vulnerability protection ?

cfpa — Fri, 25 May 2012 12:06:13 GMT

the name is "SSL Inbound Inspection" ..many thanks for your hints which directed me in this direction !

Re: How to protect an https webserver in the dmz with vulnerability protection ?

cmateam — Thu, 05 Jul 2012 23:03:42 GMT

I am wanting to do this. So I assume I upload certs and keys for our web servers to the FW. What do you do if there is an intermediate cert for those certs. Do you upload that as well? Thanks.

Re: How to protect an https webserver in the dmz with vulnerability protection ?

mikand — Fri, 06 Jul 2012 12:12:05 GMT

I dont think you need to upload the intermediate or CA certs because they are only used to verify the ssl. The PA doesnt verify the ssl when you do ssl inbound inspection - it will just sit there and sniff the ssl traffic and decrypt it using the serverkey.