topic Re: Support for inspecting SSL message for kafka connect in General Topics

Support for inspecting SSL message for kafka connect

joshualouis911 — Wed, 18 Jul 2018 20:17:13 GMT

We are using Kafka for messaging and have a requirement to inspect the SSL message sent to kafka broker from kafka connect. Kafka using binary tcp protocol with kafka broker listeners on PLAINTEXT://9093 (without SSL)

Can paloalto decrypt and inspect the kafka message content?

Re: Support for inspecting SSL message for kafka connect

BPry — Thu, 19 Jul 2018 01:20:58 GMT

@joshualouis911,

Kafka as in Apache Kafka? That would depend highly on how you've configured it. By default Kafka doesn't even use encryption so you won't even need to worry about decrypting SSL traffic.

If the data itself isn't being encrypted outside of encrypted transport, then you should be able to view the data as soon as you decrypt the transport on the firewall. Honestly though I have no idea how you would accomplish this on the firewall itself in any sort of useful format, as it isn't really designed to read the packet information and then output that for you. At beast you identify the Kafka traffic you are interested in and have it perform a packet capture on the traffic so that you could manually go back and read this information if required.

Out of curosity why would you worry about this on the firewall? The message would be plaintext on the broker (depending on how you configured it); and I assume if you are using kafka then this is internal and your organization should have access to the broker to do anything they wish with the information.

Re: Support for inspecting SSL message for kafka connect

joshualouis911 — Thu, 19 Jul 2018 08:20:43 GMT

Yes Apache Kafka, Kafka is used here to source data from a secured data center to cloud. The plan is to use Kafka connect on secured data center read data from database and transfer it to cloud we got paloalto in secured data center for inspecting the connection and traffic. Since kafa uses tcp protocol will the message be in cleartext for Paloalto to inspect.

Re: Support for inspecting SSL message for kafka connect

BPry — Thu, 19 Jul 2018 17:18:03 GMT

@joshualouis911,

if you decrypt the traffic then yes; but the firewall doesn't really care about the message itself and to the best of my knowledge doesn't have a great way of displaying/logging the actual message content.