How does the PFS Inbound Inspection work?

L1 Bithead

How does the PFS Inbound Inspection work?

Hello Team,


I am wondering how exactly the Inbound Inspection with PFS works?


Diffie-Hellman per definition has the functionality that a key agreement is happening without transfering the key through the "unsecure" channel. All passively listening instances are not able to determine (calculate) the key used for the encryption.


Well with this information ahead and the knowledge that inbound inspection is not using a proxy functionality, there is one question left for me.


How does the firewall gain the key for the encryption with PFS?



L7 Applicator

Re: How does the PFS Inbound Inspection work?

Hi @tisc


Inbound inspection actually also is kind of a proxy, but for client and server a transparent one. Beacause of this fact from a technical view inbound inspection is (like forward inspection) a MitM (Man in the Middle) attack. Between client and server ther is no longer only one decrypted session. Instead there are two: one from the client to the firewall and one from the firewall to the server. This way the firewall is able to inspect the traffic as it is cleartext on the firewall. So back to your question: there is no need for the firewall to gain the encryption keys from somewhere, as the firewall itself generates them.


Hope this helps.




Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!