topic SSL Inbound Inspection in General Topics

SSL Inbound Inspection

MohammedAsik — Wed, 31 Jul 2019 08:20:47 GMT

Hi Team

Kindly help with below query.

We approx host 100 websites of our partners. All websites are on SSL (https).

I want to configure SSL Inbound Inspection. As per my understanding, I need to import SSL certificate of 100 websites for SSL inbound inpection. However this is not feasible.

Is there any other simple way to implement the same.

Regards

Mohammed Asik M

Re: SSL Inbound Inspection

reaper — Wed, 31 Jul 2019 08:30:43 GMT

hi @MohammedAsik

No, this is required: With SSL inbound inspection, the firewall is impersonating the server by handling the ssl handshake. It needs to have the real certificate for the client to trust this connection and not throw an error

Re: SSL Inbound Inspection

MohammedAsik — Wed, 31 Jul 2019 10:38:58 GMT

Hi Reaper

I host more than 100+ websites.

Do I need to upload certificate of all websites?

Will it impact performance of Palo?

Regards

Mohammed Asik M

Re: SSL Inbound Inspection

S.Cantwell — Wed, 31 Jul 2019 13:41:34 GMT

@MohammedAsik wrote:
Hi Reaper

I host more than 100+ websites.

Do I need to upload certificate of all websites?

Will it impact performance of Palo?

Regards
Mohammed Asik M

If you want to ensure that all SSL inbound traffic is being inspected, then yes, you would want to consider having all certs on the FW.

There is always some impact with decryption, usually 10% hit in CPU utilization. Depending on the size of the FW (better performance with larger sized models of FWs) you may be able to mitigate any CPU degradation or latency.

What size FW are you working with (thinking PA5000 series FW, so please advise)

I have see companies invest in an appliance called an HSM (Hardware Security Module), that offloads all of the decryption functionality onto this appliance, so that it does the heavy math/CPU processing to decrypt/re-encrypt traffic.

Re: SSL Inbound Inspection

reaper — Wed, 31 Jul 2019 13:51:48 GMT

The performance impact lies in the total volume of decrypted sessions, not the amount of certificates. Your platform will need to be scaled to acommodate this volume and taking into account decryption.

if nearly all of your sessions are encrypted, it maybe be wise to consider one of the newer platforms (5200 series) with far superior decryption capabilities

@S.Cantwell

the HSM serves as a vault, keeping all the private keys extra private (kinda like a password manager for firewalls)

it handles all ssl handshakes, but it does not take the brunt of the decryption processing, so performance gain is near negligable

Re: SSL Inbound Inspection

MohammedAsik — Thu, 01 Aug 2019 05:27:48 GMT

Hi SteveCantwell

Thanks for your valuable infirmation.

What size FW are you working with (thinking PA5000 series FW, so please advise)?

My Answer : We are using PA 3020 firewall model. Please let us know is this model having better performance for decryption? Please advise.

Regards

Mohammed Asik

Re: SSL Inbound Inspection

Brandon_Wertz — Thu, 01 Aug 2019 17:33:55 GMT

I'm not sure of the SSL decryption inbound performance specs of the 3020, but if you're hosting over 100 sites behind it, I'm not sure it's going to have the HW capabilities you need. Another thing to consider is your encryption ciphers you're using and making sure the PAN-OS version you're running will support the decryption of that cipher.

You can also take a look at this thread which is similar to this topic:

https://live.paloaltonetworks.com/t5/General-Topics/Is-the-PA-3020-adequate-for-SSL-Decryption-and-other-features/m-p/254224

PAN-OS 7.1 - Ciphers

https://docs.paloaltonetworks.com/compatibility-matrix/supported-cipher-suites/cipher-suites-supported-in-pan-os-7-1/cipher-suites-supported-in-pan-os-7-1-decryption.html#

PAN-OS 8.1 - Ciphers

https://docs.paloaltonetworks.com/compatibility-matrix/supported-cipher-suites/cipher-suites-supported-in-pan-os-8-1/cipher-suites-supported-in-pan-os-8-1-decryption.html#

Re: SSL Inbound Inspection

BPry — Thu, 01 Aug 2019 20:37:07 GMT

@MohammedAsik,

Nobody can answer what size firewall you should invest in if this is something you are looking to do, because we don't have any of the required information. What size firewall you will need to size out depends on a lot of different factors that you will need to determine before purchase; this all depends on bandwidth requirements, session count, session per second average, the number of virtual systems you utilize, and the feature set you are looking to enable.

As others have stated I would doubt you would want to enable inbound inspection on a PA-3020 if those sites see moderate traffic levels; but with that being said they could all be low traffic sites where this would all work perfectly fine. We simply don't know from the information present.

As a side note, is this something that you have communicated to your partners and actually have their sign-off on? Before having that conversation with everyone I wouldn't even worry about sizing anything. Depending on what sort of websites these actually are you have additional considerations in actually breaking this encryption.

Re: SSL Inbound Inspection

OtakarKlier — Fri, 02 Aug 2019 20:53:54 GMT

Hello,

As previously stated, there will be a performance impact, no we cannot judge how big it will be. The newer models have their own chipsets that deal with SSL decryption so the load is less, e.g. 32XX and 52XX.

Start small, do one at a time and watch the perfomance of the PAN to see where it is. If it peaks out, you'll need to upgrade, if it doesnt keep going until all sites are done.

Cheers!

Re: SSL Inbound Inspection

MohammedAsik — Mon, 05 Aug 2019 14:41:40 GMT

Hi All,

Thanks for all to share the valuable infornation.

I will check and let you know the status.

Again thanks very much for all

Cheers

Mohammed Asik

Re: SSL Inbound Inspection

MohammedAsik — Tue, 06 Aug 2019 09:12:02 GMT

Hi Team

Just to share additional details -

We have nginx web server who acts as a proxy and directs traffic to the server where we have hosted Joomla (CMS).

Every website of Joomla (i.e partner website) is SSL with Lets Encrypt. To be precise we have 350+ websites. We recently received attack on these websites which was not detected by Palo Alto, probably due to absence of SSL inbound Inspection.

I configure my Nginx server in DMZ and Application server (Joomla) in LAN.

Nginx server will decrypt the ssl traffic and transfer through PA firewall to LAN

My question is, Will Firewall can now detect Vulnerabilities?

Regards

Mohammed Asik

Re: SSL Inbound Inspection

Brandon_Wertz — Wed, 07 Aug 2019 16:23:20 GMT

@MohammedAsik wrote:
...
Every website of Joomla (i.e partner website) is SSL with Lets Encrypt. To be precise we have 350+ websites. We recently received attack on these websites which was not detected by Palo Alto, probably due to absence of SSL inbound Inspection.

I configure my Nginx server in DMZ and Application server (Joomla) in LAN.

Nginx server will decrypt the ssl traffic and transfer through PA firewall to LAN

My question is, Will Firewall can now detect Vulnerabilities?

Regards
Mohammed Asik

I'm not familiar with Nginx, but if it's decrypting and NOT re-encrypting the traffic before it sends it on you will be fine. If the Palo is getting decrypted traffic the firewall will then be able to apply threat signatures to traffic and take action based on policy you've confgiured.