Is SSL decryption (inbound inspection) possible between 2 internal zones (subinterfaces)?

[hemarsys]

My network config is as follows

[kadak]

Hello hemarsys,

Yes, you should be able to perform decryption in between internal zones with sub-interfaces. We would just treat them as two separate layer3 zones while creating a decryption policy for inbound inspection.

Some documents that might help you:

How to Implement SSL Decryption

How to View SSL Decryption Information from the CLI

Difference Between SSL Forward-Proxy and Inbound Inspection Decryption Mode

Hope that helps!

Thanks and regards,

Kunal Adak

[hemarsys]

Thanks, I found out that it was not working by TLS 1.2.

If I disable in the browser the option  "use TLS 1.2 " then it works.

Hopefully TLS 1.2 is supported soon.

Regards,

Harry

[kadak · Accepted solution]

Hello Harry,

Yes you are right. Currently do not support decryption of TLS1.2. TLS 1.2 hasn't be broadly supported by browsers until more or less practical TLS 1.0 and block cipher related attacks where demonstrated by cryptographers as proof of concept code. We do see a slow increase of TLS 1.2 support in major browsers lately. Especially Google Chrome and Apple Safari support in their standard configuration now. Since PANOS 5.0, if we detect a TLS1.1 or TLS1.2 session, we first try to downgrade it to TLS1.0 and decrypt. If that fails, we won't decrypt the session and either drop the session or allow it encrypted based upon your policy settings.

Thanks and regards,

Kunal Adak

[hemarsys]

In PAN OS 6 SSL decryption of TLS 1.2 seems to work with Internet Explorer but with Google Chrome and FireFox currently not.

Is this correct?

Regards,

Harry