Firewall cert-SSL forward proxy-To actual destination,

Reply
L4 Transporter

Firewall cert-SSL forward proxy-To actual destination,

I know for a fact that firewall intercepts SSL connection  and generates on-the-fly cert to clients under decryption scenario. But, I wasn't able to find enough resources explaning how firewall intitates connection to the actual destination on client behalf? I mean to ask does the firewall uses palo default cert as personal certificate when intitating this connection?if so,where can I find it?

 

Please help me understand this. TIA

L7 Applicator

Re: Firewall cert-SSL forward proxy-To actual destination,

Hi @SThatipelly

 

What the firewall actually does here is a Man-in-the-middle attack on TLS connections. As you already wrote it terminates the connection and presents an on the fly generated cert to the client. This is the first connection (between client and the firewall). The second one is the connection that the firewall initiates towards the server. For this connection, the firewall does initiate a connection to the server without any client certificate - simply because there is no client cert required.

If your question is about connections where a client cert is required: these connections the firewall cannot decrypt. So for these you have to configure exceptions to make them work.

Highlighted
L4 Transporter

Re: Firewall cert-SSL forward proxy-To actual destination,

@vsys_remo Thank you for the response. I'll try to reword my question :When firewall performs a connection to server,what certificate does it use to identify itself to server? where can I find it?

 

 

L7 Applicator

Re: Firewall cert-SSL forward proxy-To actual destination,

@SThatipelly,

It doesn't use a certificate to identify itself to the server; you can't decrypt anything that actually requires a client cert. 

L7 Applicator

Re: Firewall cert-SSL forward proxy-To actual destination,

@SThatipelly

As I wrote there is no certificate that the firewall uses to identify itself. In a standard TLS handshake only the server identifies itsself to the client - not otherwise. And this is what the firewall does in this case where the firewall has the role of the client. (https://en.m.wikipedia.org/wiki/Transport_Layer_Security)

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!