SSL decription between firewall and proxy

[irshad.n]

Hi Guys,

We have a palo alto 3020 firewall in peremeter and websense proxy server in internet network acting a explicit proxy. So users are browsing internet through proxy server and the proxy will forward the traffic to internet via PA firwall.

We need have following requirment.

* Enable ssl decrption in PA firewall and inspect any traffic coming from websense to inspect and if required to send suspicias trafic to wildfire cloud

* enable SSL decryption in websense and between clients.

so in two locations the traffic will be decrypted for insplection.

In the above scenario. Clients will have self signed certificate of websense. So websense will inspect traffic coming from clients.

So.. how to configure PA firewall for ssl decryption? is it similar to client to firewall decryption where we generate a self signed certificate and export it to websense. so firewall will act as MITM.?

NEED your adivce on above setup?

Regards

Irshad

[bradk14 · Accepted solution]

essentially, yes. assuming you don't have an enterprise CA (which I'm guessing you don't, given that you're using a self-signed on the proxy).

what you may/should be able to do is export the private/public key of the cert on the proxy and import and use it as your forward trust certificate on the PA. that way you don't need to retrain any clients to trust the PA cert.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Implement-and-Test-SSL-Decryption...