Firewall cert-SSL forward proxy-To actual destination,

cancel
Showing results for 
Search instead for 
Did you mean: 

Firewall cert-SSL forward proxy-To actual destination,

L4 Transporter

I know for a fact that firewall intercepts SSL connection  and generates on-the-fly cert to clients under decryption scenario. But, I wasn't able to find enough resources explaning how firewall intitates connection to the actual destination on client behalf? I mean to ask does the firewall uses palo default cert as personal certificate when intitating this connection?if so,where can I find it?

 

Please help me understand this. TIA

1 ACCEPTED SOLUTION

Accepted Solutions

@SThatipelly

As I wrote there is no certificate that the firewall uses to identify itself. In a standard TLS handshake only the server identifies itsself to the client - not otherwise. And this is what the firewall does in this case where the firewall has the role of the client. (https://en.m.wikipedia.org/wiki/Transport_Layer_Security)

View solution in original post

4 REPLIES 4

Cyber Elite
Cyber Elite

Hi @SThatipelly

 

What the firewall actually does here is a Man-in-the-middle attack on TLS connections. As you already wrote it terminates the connection and presents an on the fly generated cert to the client. This is the first connection (between client and the firewall). The second one is the connection that the firewall initiates towards the server. For this connection, the firewall does initiate a connection to the server without any client certificate - simply because there is no client cert required.

If your question is about connections where a client cert is required: these connections the firewall cannot decrypt. So for these you have to configure exceptions to make them work.

@vsys_remo Thank you for the response. I'll try to reword my question :When firewall performs a connection to server,what certificate does it use to identify itself to server? where can I find it?

 

 

@SThatipelly,

It doesn't use a certificate to identify itself to the server; you can't decrypt anything that actually requires a client cert. 

@SThatipelly

As I wrote there is no certificate that the firewall uses to identify itself. In a standard TLS handshake only the server identifies itsself to the client - not otherwise. And this is what the firewall does in this case where the firewall has the role of the client. (https://en.m.wikipedia.org/wiki/Transport_Layer_Security)

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!