So as a decryption or SSL forwarding proxy, SSL encryption, decryption lab point of view, we have
already created our.
We have created our work for you and that work is actually here.
So, you see, this is the workbook we have already pasted in your convertors, new self signed certificate
and step by step configuration.
Just so first of all, the first step is creating and generating create, generating a new self signed
certificate, SSL certificate, that certificate we need to create once I do, the steps are here,
documented in this lab, documented in the workbook document.
So first of all, you need to log into the panorama.
And in the panorama you select the actual firewall management.
Damply.
OK, so at your firewall management, because that's related to the device.
Once you do that, then you go to the certificate in the device.
OK, and then you see device and cert and what you do, these are the steps you need to generate.
We are generating this from Palo Panorama generate.
It is a local.
Certificate will be SSL decryption.
And it's the Shishir location, so it can be visible everywhere.
Domain name, for example.
Signed by the we we don't need to sign by we need to select this certificate authority.
Honestly, 258 and all those information.
You can type some kind of attribute, for example, country, you can type this, for example, UK.
OK, these are some of the attributes you can select.
And you can say the department, you can say it.
So some of the attributes you can say the email, for example.
OK, so you can see once you hit that, some of the attributes here, you can generate this.
Successfully continue to keep it.
So, you see, that's a sign you need to see.
OK.
Once you hit that, you double click this now and enables these two options, forward cert and forward
until certificate.
OK.
He took after this.
Now, this certificate is actually generated.
Now.
OK, once you install the certificate, then the second step is we are going to create the we are going
to create our policy, creating a decryption rule.
Which is going to be done by the logging into the firewall and creating a rule in the decryption policy.
So, for example, we need to go into the policy.
We see in the decryption rules and here we are creating my decryption policy.
Decrypt.
Policy.
So sources win will be trust lately, trust.
Source address will be it's my IP.
So what, you need to select your IP as well as your Langridge.
Do not select everything destination point of view, this will be Internet.
What any kind of address?
Services, any services anywhere else for the time being, and this is what you need to select.
It's a self-fulfilling prophecy.
Guys, just hold on a second.
OK, let's back on.
So basically, as we're seeing, we are creating this decryption rule in our decryption policy, we
are selecting our military source IP from the landside going to Internet services, any and we need
to collect this decrypt and SSL forwarding.
So these are the two steps we need to do.
In addition to that, we also need to go into the our.
Firewall complete.
And look at the response pictures so you can see the SSL decryption output page.
If you look this, we have to.
That's not good, which is to deceiver.
Naval.
So we enable this as well.
And then we push to change.
OK, so we are pushing the changes now to the panorama.
Understanding what will be happening now, so I have logged into this internal machine then to a five
year old or 11 my and then I'll be sending the traffic to the Internet and you will be seeing what will
be happening.
So let's see the configuration need to be pushed completely or is it.
Oh, why does it feel.
Oh, just one.
So obviously, it gives them a message no more.
Seventy five percent.
OK, so the rule is there now in the firewall, we can see it is completed successfully.
So previously it gives some error message related to some charity.
Now, it gave some areas some kind of you know, this is fine.
So basically this is done.
So now let's go into the machine.
And look for the.
And let me go to the G.M..
So you see what is happening now, the connection is not secured, so let's give you some air message.
OK, so what happened, Eveillard certificate is said, if it is not a valid.
You see, the connection is not secure, any website when you go to Google.
The connection is insecure and this is the message you're getting because the browser does not have
the certificate, which is trust, which has been generated by the by the by initially by us with a
self signed certificate.
Because initially now what happened?
The firewall, the traffic is forwarding from the.
From the machine gun to coming to the firewall firewall, intercepting their traffic and giving its
own certificate, which is not trusted by the browser, and that is why we're giving an error message.
So this is we the step second is we need to trust that certificate inside our browser.
We need to install that certificate so we can install the certificate.
The certificate is already created.
The certificate is existing here in the Panorama in the certificate section.
OK, so we're not here in the device at your firewall management, so this is the certificate we have.
So one way we can export this certificate and then import inside the browser, OK, inside the browser
here, the second way you can do, you can actually log into.
This.
OK.
OK, let me try it.
Just copied this certificate into the browser, then browser will start giving a start, stop giving
you any error message.
So we look into the panorama and you can actually.
Export this.
Certificate.
First of all, into the machine, so you're not in.
Not created.
CERT is here.
Have actual actual level management.
Why doesn't she have the certificate?
So this is the certificate I expected that and I'm going to export it.
Normally in the environment, this certificate will be exported by the GPO.
Actually, if you are aware of the Visa, Microsoft, keep your policy through the group policy to all
the users browsers.
Come on.
So he's downloaded here.
After that, he did install into the browser.
So there are some steps we have already shown you here.
How we can install those cute.
On a serious note here.
OK, you go into this option advance certificate and view certificate, and here you need to import
that certificate, right?
So basically, the machine No.
Come on.
Option.
So he selected the wrong one.
Afshin.
And you go into the advance.
Certificate.
New certificate.
And import.
Yeah.
And the authorities right here waiting too important to sort of.
Now we accept the HSBC.
Or maybe Facebook, for example.
Huh?
Long physically, we need to import the certificate right now, so basically the steps are to need to
follow these steps, the certificate for website.
Yeah.
So now you see what happened.
The of action, if you will, proceed with this and include the company policy, SSL encryption.
This is the this is what why it is happening, because we have actually selected the response pages
as well as the response pages are sure are good to, you know, sometimes give some user error message
and some kind of warning as well.
We have selected this one warning pages.
Remember, this was the response pages and the response pages.
We have enabled this SSL encryption.
It was enabled we just enabled this enable SSL output options.
So as a result, now what we can see there is an edited message.
If you proceed with this session, then the current company policy assessment traffic will be initiated
by the decrypted so that it can be inspected by the viruses, spyware and malware.
After inspection, the traffic will complete and send your destination IP address any category.
Yes.
So you see now it is encrypted.
If you look at the certificate now, it will be not the actual certificate, which is a drop box one,
but actually the for the final one.
Come on.
OK, now let's see the certificate.
You see the three local certificate.
That's what we have to remember this certificate, we have to read it now.
This will be presented by the this is the certificate we have created.
So now the brothers are trusting the certificate because reinstalling the browser.
OK, this is the certificate for local.
OK, these are Dropbox's let's see if I go my machine in my computer and if I say I accessed the Dropbox
so you will see the actual Dropbox, I it is different.
OK, it is used by the U.S., it is by the Digicel, but the certificate is presented by our firewall,
it is the local certificate by generated by us.
So remember, this is the certificate we have generated if we look at the details now.
OK, so what does serial number certificated tell?
Public key, for example, and many other information you can see from here, but this is not a certificate
by the provided by the Dropbox's itself.
It is a certificate issuer, for example, in 448 local IT U.K. So you can see this is the certificate
provided by the hour firewall and it's intercepting the traffic and read what is going through in the
tunnel.
So there is an enhanced capability of a firewall which inspecting the SSL traffic for you.
OK.
But even you see.
So this is the I will I will give you the next point now.
So that's all the how we can do the SSL inspection.
Any questions so far?