- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
04-18-2020 09:50 PM - edited 04-18-2020 10:56 PM
Hi Everyone,
Learned something new from you today.
We are going to enable SSL decryption for Inbound traffic coming from Internet to our web servers.
Need to know when does PA intercept the traffic coming form Internet to the web server which is hosting the website?
During 3 way TCP handshake or when first Data packet comes?
Regards
MP
04-18-2020 10:31 PM
This is one of my favorite questions, because the answer is truly that it depends on the type of connection.
For RSA keys, the firewall is able to inspect the traffic without terminating the connection. As the connection crosses the firewall it's going to make a copy of the session and decrypt it so the firewall can apply the appropriate policy to the traffic.
For PFS keys using DHE or ECDHE, the firewall has to proxy the connection between the client and the server. Due to the way the key is generated, we can't transparently sit in that connection even with the certificate and the private key installed. So the firewall is going to create a connection from the client to the firewall, and the firewall to the server to proxy that connection.
04-18-2020 10:54 PM
Hi Bpry,
If the Connection is using RSA keys then we should not see checked decrypted flag under traffic logs right?
And when the connection is using DHE we should see decrypted flag checked under the traffic logs right?
So this way we can see if connection is RSA or DHE right?
Regards
MP
04-20-2020 09:38 AM
Also i tested this on port 443 it always shows traffic as decrypted.
is this default behaviour?
How can i check if client is using RSA ?
doing pcap on the PA
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!