topic Re: SSL Inbound // decrypt-unsuppot-pram in General Topics

SSL Inbound // decrypt-unsuppot-pram

raji_toor — Wed, 24 Jun 2020 18:37:04 GMT

What can i do here..Is it something we have to fix on server side or firewall.

Not Working, Block sessions with unsupported cipher suites, Selected.

Protocols allowed min SSL3.0 to MAX

Working, with Block sessions with unsupported cipher suites, Un-selected.

NMAP scan of server

Re: SSL Inbound // decrypt-unsuppot-pram

raji_toor — Wed, 24 Jun 2020 18:37:57 GMT

NMAP Scan for server

Re: SSL Inbound // decrypt-unsuppot-pram

BPry — Thu, 25 Jun 2020 04:05:36 GMT

@raji_toor,

Was this ever working before or is this the first time you are attempting to decrypt this traffic? Setting up inbound decryption on the PFS ciphers is a bit different then it was previously because the firewall actually needs to proxy the connection instead of just decrypting the traffic in-line like it can with older ciphers.

Also just glancing at your cipher list you have a few being offered that the firewalls doesn't actively support. You'll want to check the available ciphers for your software release as this changes between most major releases and ensure that the firewall supports each being offered.

Re: SSL Inbound // decrypt-unsuppot-pram

raji_toor — Thu, 25 Jun 2020 15:37:40 GMT

@BPry Yes this is my first attempt at inbound decryption, i do have outbound working for few months now.

On comparison for what is supported for 9.0 and what the nmap shows me, i see quite few are common between them.

After enabling inbound inspection namp sees only 2, profile setting for now allows 3.0 to 1.2

So how do i proxy the connection, the only to configure is see is to have the cert on firewall, create decryption profile and attach to decryption policy. Policy/Profile don't seem to provide any option for proxy.