Outbound SSL decryption.
So what we are going to discuss what is essential decryption or what will component, but also necessary
description, overview, but also outbound SSL decryption configuration configuration, example, configuration
with the URL without you.
Recommendation example as well.
So if you look at the traffic flow, when the applications, when the traffic is hitting from the outside
to internal actually or the Internet outside, so you can see at the application level check for encrypted
traffic.
Is a distribution policy and post policy, check the encrypted traffic.
So this is what we are discussing here with regard to.
So first of all, decryption overview, what is decryption?
Palo Alto does the part of Palo Alto.
What does the Palo Alto firewall decrypted traffic session attempt to hide the replication signature
will encrypted seven information session attempting to hide in the encrypted file.
Palo Alto File will act as a proxy fight.
Well, a man in the middle approached for the decryption, followed a solution to report SSL outbound
inbound and a search warrant to.
So basically, if you look at nowadays, mostly the Internet websites, nowadays, websites are accessible
over the HTP s.
So like, for example, if you do the Facebook actually the Facebook website and you can see, for example,
even BBC website, they are you can see this and most likely another one, for example, HSBC, for
example, website as well.
They are mostly the 90 to 80 to 90 percent traffic is secure communication.
We know the HDP actually is not secure, but setpiece is secure.
So connection between your machine to the server, the encrypted.
For example, I am using Facebook.
This is my Facebook page.
And the communication across between Facebook server and my machine is actually completely secure.
And you can see also this is also certificate because of this certificate is valid certificate ID check
the identity that you are connected to the right server.
Similarly, it just visa.
You can see the secure connection is secure.
There are some websites, mostly nine, 90 percent of the websites are actually 90, 70, 80, 85 to
90 percent websites are based.
The reason is because Google read them quite high also.
Also, it is for the security reasons as well.
When you access the banking website, for example, you can also.
You can actually logon to the banking website and all the communication between your server, your machine
to the server is completely secure.
But just look what is happening actually behind the scenes.
So basically the used public key infrastructure of using both symmetric and asymmetric encryption,
symmetric encryption, there are two very public and private key.
Authenticators key.
Symmetric encryption is a single key shirkey, like just a password between the two and host and the
communications start happening between them and actually publicly the kippie when we have a Kebir,
not a single key, it is more secure as compared to the single key because we actually share the public
key, but we don't share the private key.
Everyone has its own private key, but the public is shared over infrastructure and most likely the
public is shared over the infrastructure by the by the certificate.
If you look at the certificate here, you might see the.
Look at this public look, this is a public, actually.
So there are two key one is the private, one is the public, OK, we we are not going into much detail,
actually, if you want to go for that detail, either you do cybersecurity, CNN or maybe network security
plus.
But here we are, just giving you an idea actually what is happening behind the scenes.
Does this certificate actually sharing the public between the two handheld devices and also and also
verify the identity of the system that you are connected to the rights or where you not connected to
any server between the men in the middle kind of server?
So you see that servery certificate is OK by the browser, so browser actually has the many services,
certificates, services installed.
You can install the certificate from any service certificate authority as well.
OK, so basically the public infrastructure is more secure.
So what happens normally in a socket secured like a socket communication?
SSL communication, internal user, what is happening, it request the SSL component, the server respond
with it, sends the certificate client, the browser actually basically client verify the server cert
if the verify it does not verify the server cert it give you an error message.
For example, right now when we access our website, we access the when we access the our.
For example, our firewall.
Because the certificate is not trusted by the browser, the browser will give you an error message.
For example, you can see this one.
This connection is not secured.
It gives you an error message.
Similarly, if you access our firewall on the Palo Alto, you will see some kind of error message that
these firewalls, the certificate is not secure.
OK, so basically it verified what happened in the initial communication user requested SSL connection
servers and respond with a certificate it verified with the user is sending Capecchi exchange and then
it's stored communication, encrypted communication between the server and your machine.
No, what happened, this is this is exactly what it explained, a client request, SSL connection,
so to respond, the client validate if the certificate is valid, the client used the key to this meeting
session and send it to the server.
At this point, both inside of communication have the same strategy again, began sending bulk data
over there secure Janet.
So this is the certificate, and you can see when you need a certificate, actually, you need basically
issuing authority Yuzuki valid from subject public e-signature.
So these are the information you need to provide in order to generate a certificate.
And this is the sort of good example I just showed you, if the for the Facebook, they bought this
certificate from the digital certificate.
So certificate is like when you do piquancy, for example, or Tuscany or any degree program, you will
be verified that you have passed the certificate and the the authority to give you the certificate that,
OK, you have done this, you have successfully passed this exam.
So there are two types of certificate.
One is the self sign and one is certificate authority.
So Certificate Authority may be a third party or maybe you have an internal certificate authority self
sign.
Maybe you have your own like when you access the Palo Alto and you get the self signed certificate errors
straightforward, but this one is required some work and cost as well.
You need to buy this from third party.
Third party will verify the identity audit for the lab environment item for the multi box environment.
To avoid the of error user need to trust each viable certificate.
User only need to trust one certificate authority.
Now, what is happening here?
If you do not inspect the traffic between the firewall, between the basically firewall, actually.
OK, if I will let you let this traffic go through right now, as as of now, we we can see that we
are we are blind, actually, so maybe there are viruses warms.
Our user can actually build some kind of tolerance just for the traffic over.
And if you do not encrypt the traffic at the firewall.
So basically what happening?
Decryption, we call it the old one SSL inspection by the forwarding proxy.
So firewall in the middle, sitting at it, intercept the connection requested by the internal user.
And then it sent its own cert 500 generated and sent its own cert, then on behalf of this user, it's
created a session with the external server servers and the set of keys to the firewall.
So far, well into sitting in the middle, so it's like a man in the middle of you're hacking yourself
sitting between the user and the server and you are trying to hack the traffic between them.
If you do not hack this traffic and if you do not inspect the traffic, there are many chances that
some of the files can be downloaded.
They have some viruses and spyware and all those things.
So this file, this traffic has to be inspected by the firewall.
So if there are any viruses home and somebody try to build a tunnel from his machine to outside, it
can be inspected and the SSL layer and actually break the communication and then fight about on behalf
of user initiated connection with the server.
So this is behind the scene is happening, that's what is called SSL decryption or SSL inspection by
the forwarding proxy.
What we normally do, we can just create a policy and we can say SSL forwarding and decrypt, OK?
We can check with the troubleshooting commands as well, not lab point of view.
I'll show you what you need to do.