topic Re: Is SSL decryption (inbound inspection) possible between 2 internal zones (subinterfaces)? in General Topics

Is SSL decryption (inbound inspection) possible between 2 internal zones (subinterfaces)?

hemarsys — Thu, 14 Nov 2013 13:01:43 GMT

My network config is as follows

Re: Is SSL decryption (inbound inspection) possible between 2 internal zones (subinterfaces)?

kadak — Thu, 14 Nov 2013 16:01:07 GMT

Hello hemarsys,

Yes, you should be able to perform decryption in between internal zones with sub-interfaces. We would just treat them as two separate layer3 zones while creating a decryption policy for inbound inspection.

Some documents that might help you:

How to Implement SSL Decryption

How to View SSL Decryption Information from the CLI

Difference Between SSL Forward-Proxy and Inbound Inspection Decryption Mode

Hope that helps!

Thanks and regards,

Kunal Adak

Re: Is SSL decryption (inbound inspection) possible between 2 internal zones (subinterfaces)?

hemarsys — Thu, 14 Nov 2013 18:49:15 GMT

Thanks, I found out that it was not working by TLS 1.2.

If I disable in the browser the option "use TLS 1.2 " then it works.

Hopefully TLS 1.2 is supported soon.

Regards,

Harry

Re: Is SSL decryption (inbound inspection) possible between 2 internal zones (subinterfaces)?

kadak — Thu, 14 Nov 2013 19:01:49 GMT

Hello Harry,

Yes you are right. Currently do not support decryption of TLS1.2. TLS 1.2 hasn't be broadly supported by browsers until more or less practical TLS 1.0 and block cipher related attacks where demonstrated by cryptographers as proof of concept code. We do see a slow increase of TLS 1.2 support in major browsers lately. Especially Google Chrome and Apple Safari support in their standard configuration now. Since PANOS 5.0, if we detect a TLS1.1 or TLS1.2 session, we first try to downgrade it to TLS1.0 and decrypt. If that fails, we won't decrypt the session and either drop the session or allow it encrypted based upon your policy settings.

Thanks and regards,

Kunal Adak

Re: Is SSL decryption (inbound inspection) possible between 2 internal zones (subinterfaces)?

hemarsys — Thu, 23 Jan 2014 21:29:05 GMT

In PAN OS 6 SSL decryption of TLS 1.2 seems to work with Internet Explorer but with Google Chrome and FireFox currently not.

Is this correct?

Regards,

Harry