topic SSL Inbound Decryption and PA in General Topics

SSL Inbound Decryption and PA

MP18 — Sun, 19 Apr 2020 05:56:35 GMT

Hi Everyone,

Learned something new from you today.

We are going to enable SSL decryption for Inbound traffic coming from Internet to our web servers.

Need to know when does PA intercept the traffic coming form Internet to the web server which is hosting the website?

During 3 way TCP handshake or when first Data packet comes?

Regards

Re: SSL Inbound Decryption and PA

BPry — Sun, 19 Apr 2020 05:31:13 GMT

This is one of my favorite questions, because the answer is truly that it depends on the type of connection.

For RSA keys, the firewall is able to inspect the traffic without terminating the connection. As the connection crosses the firewall it's going to make a copy of the session and decrypt it so the firewall can apply the appropriate policy to the traffic.

For PFS keys using DHE or ECDHE, the firewall has to proxy the connection between the client and the server. Due to the way the key is generated, we can't transparently sit in that connection even with the certificate and the private key installed. So the firewall is going to create a connection from the client to the firewall, and the firewall to the server to proxy that connection.

Re: SSL Inbound Decryption and PA

MP18 — Sun, 19 Apr 2020 05:54:03 GMT

Hi Bpry,

If the Connection is using RSA keys then we should not see checked decrypted flag under traffic logs right?

And when the connection is using DHE we should see decrypted flag checked under the traffic logs right?

So this way we can see if connection is RSA or DHE right?

Regards

Re: SSL Inbound Decryption and PA

MP18 — Mon, 20 Apr 2020 16:38:18 GMT

Also i tested this on port 443 it always shows traffic as decrypted.

is this default behaviour?

How can i check if client is using RSA ?

doing pcap on the PA