topic Re: Decryption policy Issue in General Topics

Decryption policy Issue

homicidedart — Sun, 09 Feb 2014 10:51:21 GMT

Hi All,

I'm just trying to configure decryption. because I'm facing Issue while blocking applications(not all the applications got blocked as the policy supposed to do).

First of all, I'm using Trusted CA, and here you are the steps I followed To generate MY certificate.

2. then I uploaded that Certificate to the Trusted CA, and then I got a signed Certificate.

3. I configured a Decryption Profile as below.

4. then I created the decryption policies as below

but finally while I'm trying to commit the Configuration I got the error vsys1 decryption: forward decrypt trust cert is not configured

I don't know what's wrong with that, also does my configuration is correct, or I'm going the wrong direction.

Regards,

Maher

Re: Decryption policy Issue

Retired Member — Sun, 09 Feb 2014 11:22:58 GMT

This is because you did not configure the certifiate for decryption

Difference Between SSL Forward-Proxy and Inbound Inspection Decryption Mode

Re: Decryption policy Issue

homicidedart — Sun, 09 Feb 2014 11:29:53 GMT

That's because when I import the Signed Certificate, All the Check boxes are disabled, as attached in the photo

Regards,

Maher

Re: Decryption policy Issue

Retired Member — Sun, 09 Feb 2014 12:14:21 GMT

A certificate signed by CA can be used for

Captive Portal ("CP") pages
Response Pages
GlobalProtect ("GP") Portal

How to Install a Chained Certificate Signed by a Public CA

When using ssl decryption you cannot use a system that a client will not get a ssl warning (wihtout importing the certificate to the client).This is why ssl is safe.

if it is used for SSL decryption, it should be CA certificate.

Re: Decryption policy Issue

homicidedart — Mon, 10 Feb 2014 15:12:44 GMT

Thanks panos for your kind help.

Regards,