Firewall cert-SSL forward proxy-To actual destination,

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Firewall cert-SSL forward proxy-To actual destination,

L4 Transporter

I know for a fact that firewall intercepts SSL connection  and generates on-the-fly cert to clients under decryption scenario. But, I wasn't able to find enough resources explaning how firewall intitates connection to the actual destination on client behalf? I mean to ask does the firewall uses palo default cert as personal certificate when intitating this connection?if so,where can I find it?

 

Please help me understand this. TIA

1 accepted solution

Accepted Solutions

@SThatipelly

As I wrote there is no certificate that the firewall uses to identify itself. In a standard TLS handshake only the server identifies itsself to the client - not otherwise. And this is what the firewall does in this case where the firewall has the role of the client. (https://en.m.wikipedia.org/wiki/Transport_Layer_Security)

View solution in original post

4 REPLIES 4

L7 Applicator

Hi @SThatipelly

 

What the firewall actually does here is a Man-in-the-middle attack on TLS connections. As you already wrote it terminates the connection and presents an on the fly generated cert to the client. This is the first connection (between client and the firewall). The second one is the connection that the firewall initiates towards the server. For this connection, the firewall does initiate a connection to the server without any client certificate - simply because there is no client cert required.

If your question is about connections where a client cert is required: these connections the firewall cannot decrypt. So for these you have to configure exceptions to make them work.

@Remo Thank you for the response. I'll try to reword my question :When firewall performs a connection to server,what certificate does it use to identify itself to server? where can I find it?

 

 

@SThatipelly,

It doesn't use a certificate to identify itself to the server; you can't decrypt anything that actually requires a client cert. 

@SThatipelly

As I wrote there is no certificate that the firewall uses to identify itself. In a standard TLS handshake only the server identifies itsself to the client - not otherwise. And this is what the firewall does in this case where the firewall has the role of the client. (https://en.m.wikipedia.org/wiki/Transport_Layer_Security)

  • 1 accepted solution
  • 4119 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!