In this video we'll be taking a look at decrypt and scan of HTTP traffic, also
known as deep packet inspection of SSL traffic, or DPI SSL for an XG Firewall.
Before we get started you need to understand what is involved with using
this very important security feature. Here are some things to consider before
using decrypt and scan HTTPS. Make sure you have an understanding of how digital
certificates work with SSL communication between you and an HTTPS website.
Understand how putting the firewall in the middle of this HTTP communication
can cause browser warning issues with users for every HTTP website they visit.
How to update user browsers with the firewalls self-signed certificate that
you know which firewall policies in zones you enable DPI SSL on. So why you
use decrypt and scan HTTPS or DPI SSL? Well more than 60% of all web sites are
now HTTPS . The 'S' in HTTPS means the connection to the website is secured and
encrypted using SSL. Traditional HTTPS traffic traversing through a firewall is
encrypted and therefore is not inspected by the firewall. Hackers know this. So to
combat this you must decrypt and scan HTTPS traffic. This is done using an old
vulnerability as a protection mechanism called man-in-the-middle attack. As data
travels between you and the HTTPS website the firewall sees that in the
middle. The firewall then breaks open that SSL, session does its normal traffic
scanning to make sure there's no vulnerabilities in that traffic, and
then encrypts it back up and says it's on its way. When connecting to an HTTPS
website, that public HTTPS website has a digital certificate tied to it. The
digital certificate contains information keys that allow you and the HTTPS
website to communicate, how you're going to encrypt and decrypt the data you send
back and forth. A digital certificate verifies that the HTTPS website you are
connecting to is real, and has been verified and validated to be real by a
certificate authority. In order to add the firewall in the middle of an HTTPS/SSL
connection, the firewall has to know how to decrypt the HTTPS traffic for
inspection, and then re-encrypt that traffic to be sent on. The connection to
the HTTPS web site with the firewall in the middle doing DP-SSL, and the
simplest terms happens like this: you request an HTTPS site the HTTPS webserver
replies with the information keys that you need for an exchange for the SSL
session. The firewall sees this and replies to the web server like it's your
device. The firewall then replies to your device as it is the HTTPS web server
using its own self signed certificate. Because your browser sees this self
signed certificate and that has not been authenticated by a certificate authority,
you will see a connection not secure warning page. After you click through the
warning pages normal communication is observed for that session. To avoid this
warning page for every HTTPS website you connect to, you need to import the
firewall self signed-certificate into the digital store of each browser you
and your users are going to be using. Importing the firewall self signed
certificate is key to using this feature. You can import the self signed
certificate from the firewall into each browsers digital store manually, however
this is not practical at all. Internet Explorer, Chrome, and Safari for windows
browsers use the Microsoft digital store on the device you are using.
Pushing the self signed certificate to these browsers can easily be done with a
group policy update through Active Directory. Firefox and Safari for Mac OS
use their own digital store and can be updated manually or through scripts. Now
I'm going to show you the user experience for both before and after
turning on decrypt and scan HTTPS or DPI-SSL. I am also going to show how to
import the firewalls self-signed certificate into my browser, then end up
showing how to import the self-signed certificate in Active Directory so it
can be pushed out to all your users via group policy update. First I want to log
in to the firewall and show that the decrypt and scan HTTPS option is not on
for the internet firewall access rule. To show the firewall access rule, click on
firewall in the protect section of the left-hand navigation bar.
Next I'm going to click on my internet access rule and then on the Edit icon
scroll down to the malware scanning section and you can see that to decrypt
and scan HTTPS is not checked. I'm now going to switch over to my browser and
type in www.google.com. See I can access the website without any problems and notice
how Google defaults to a secure connection with HTTPS. Now back in the
firewall I'm going to click on the check box for decrypt and scan HTTPS, which
will turn on DPI-SSL. Click Save at the bottom. I'm now going to switch back to
my browser and try to go to www.google.com. Now with decrypt and scan HTTPS turned on,
I get the connection is not secure warning page. That's because I'm now
talking to the firewall and seeing its self signed certificate. I click through
the warnings that I can now see Google's webpage. Now I'm going to manually import
the firewall self signed certificate into my browser, by clicking on tools
then options. Now click on advanced, and then view certificates. Click on the
import button then browse where you have saved the certificate. Click on the
security appliance SSL certificate and then on open. I'm going to click the
check boxes and then Ok, and then Ok again to close the certificates window.
Now that I have imported the certificate in a browser window I'm going to type
WWW.Google.com, and I'm now able to see that page, or any HTTPS website without
any problems. As you've just seen that would be very cumbersome to do for all
the users in your network. Like I mentioned early in the video you can use
scripts to import the firewalls self-signed certificate for Firefox and
Safari for Mac OS, however since most of the vast majority of networks have an
active directory with a domain controller, I'm going to show how to
import the self-signed certificate so it can be pushed as a group policy update
to the Microsoft digital certificate store for use with Internet Explorer and
Chrome. Launch the group policy manager, hover over the default domain policy, and
right mouse click and then click on Edit. Click to expand out computer
configuration, then expand Windows settings,
that expands security settings then expand public key policies. Now hover
over trusted root certificate authorities, and then right mouse click
and then click on Import. Click on the Browse button to browse out where you
have saved the firewall self-signed certificate. You may have to change to
view all files to see the firewall certificate, and then click Next.
Make sure that the certificate store field says trusted root certification
authorities and then click Next. On the import completion screen click on Finish.
You should now be able to scroll and see the firewall self-signed certificate
displayed in the list of certificates on the right-hand side. On the next group
policy update for your users that certificate will be placed in the
Microsoft digital certificate store. Just one last reminder: for any firewall
access rule that you want to turn decrypt and scan HTTPS on for, in the
firewall access rule go to the malware scanning section, and click the check box
for decrypt and scan HTTPS. This turns on the decrypted scan and does DPI-SSL for
that firewall access role. Thank you for watching this video, and I hope you found
it helpful.