we just configured our first SSL Inbound decryption, but we have some trouble and need help troubleshooting it.
Very simple setup:
Webserver in DMZ zone
Firewall policy: from:untrust to:dmz; src:any; dst:webserver; app:ssl,web-browsing; service:service-http(s); action:allow
Decryption policy: from:untrust to:dmz; src:any; dst:webserver; action:decrypt
The webserver's certifictate and key have been imported to the firewall.
Accessing the webserver from an external PC: Traffic gets decrypted perfectly.
Accessing the webserver from an iPhone and from and Android device: Traffic is *not* being decrypted.
In all cases the source IPs were completely random and are not subject to any firewall rule. This is reproducible and I tried to find out why it would decrypt in one case but not in another.
Any ideas? Is there a way I can troubleshoot this other than looking at the traffic logs, which don't contain any helpful information?
I've got two pcaps open right now, and it looks like the difference between the two of them is the TLS version that was negotiated.
The pcap I captured of a session where decrypt seems to work has TLSv1. The pcap of the session where decrypt did NOT appear to work negotiated TLSv1.2.
Can somebody else confirm what I'm seeing?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!