topic Re: Design suggestions in General Topics

Design suggestions

raji_toor — Mon, 19 Feb 2018 21:47:20 GMT

We are trying to implement SSL offload using proxy gor our hosted websites, so they can be inspected by firewalls. Management currently is more alligned to SSL offload by proxy rather than decryption by FW and it is working the way below. But with the cenario below they are also concerned about the password being revealed after SSL offload. How can i mitigate that. This is a typical web application scenario for us and is using web servers uing ldap/s.

Re: Design suggestions

OtakarKlier — Tue, 20 Feb 2018 17:08:34 GMT

Hello,

The decryption only happens within the PAN software and is not revealed. So in you scenario, it would look like the following:

external client -> SSL-> PAN (decrypted and inspected) -> SSL -> Webserver

So the only time its decrypted is so the PAN can inspect the traffic, i.e. within the device.

Hope that makes sense,

Re: Design suggestions

raji_toor — Tue, 20 Feb 2018 17:28:55 GMT

@OtakarKlier Management is more alligned to SSL offload by the proxy rather than decryption by firewall. Once traffic enters firewall it is encrypted, it then exits to reach proxy where it is decrypted and then enters back into firewall and then out to the server.

Re: Design suggestions

OtakarKlier — Tue, 20 Feb 2018 17:41:35 GMT

Maybe have a small subnet between the proxy and the server? That way its locked into that small area, like a DMZ.