topic Re: control over ssh traffic - command or data in General Topics

control over ssh traffic - command or data

Gururaj — Tue, 17 Nov 2015 07:38:15 GMT

Hi All,

After implementing SSH decryption, can PA have the visibility to idenfity whether commands or any other data is being shared over ssh

with regards,

Ram

Re: control over ssh traffic - command or data

Raido_Rattameister — Tue, 17 Nov 2015 10:45:52 GMT

ssh is basically encrypted telnet.

So when you decrypt it then yes you can see what is going inside it.

Re: control over ssh traffic - command or data

Gururaj — Tue, 17 Nov 2015 12:02:39 GMT

It is understood that once the we decryption is done we can see whats inside, but i want to block control and allow data is that possible.

with regards,

Ram

Re: control over ssh traffic - command or data

rmonvon — Tue, 17 Nov 2015 15:59:57 GMT

Hi there...At this time, the SSH decryption is designed to detect tunneling traffic inside of SSH (port forwarding) and block the tunneling. Per the 7.0 manual:

"With the an SSH Proxy decryption policy enabled, all SSH traffic identified by the policy is decrypted and identified as either regular SSH traffic or as SSH tunneled traffic. SSH tunneled traffic is blocked and restricted according to the profiles configured on the firewall. Traffic is re-encrypted as it exits the firewall."