Hi there. In this video we will provide a brief overview of the new TLS inspection
engine in XG Firewall version 18 with a quick demonstration of how to configure
it. The new SSL inspection engine in version 18 delivers high performance,
high connection capacity with support for TLS 1.3 and all modern cipher suites.
It is port and application agnostic so it doesn't need to know about what
higher-level application is being used. The SSL policy for the new inspection
engine is now separate from the firewall rules. This allows you to create and
apply policies to traffic without the complexity of having to consider the
ordering and matching of firewall rules. Once decrypted the new SSL inspection
engine sends the packets to IPS, application control, web filtering, and
antivirus for checking. Before we jump into the configuration it is important
to understand when the TLS inspection rules are used. XG firewall version 18
still supports the web property for decrypting and scanning HTTP and HTTPS
traffic on ports 80 and 443 however this does not offload to the Fastpass. The web
proxy can be enabled in the web filtering section of the firewall rule.
If it is enabled then all SSL traffic except for port 80 and 443 and handled
by the TLS Inspection rules. When the web proxy is not selected as in the
example shown here then all the SSL traffic regardless of the port is
handled by the TLS inspection rules. Let's take a look at how you can get
started with the configuration. In rules and policies you will find the SSL TLS
inspection rules tab here you will find there are two default exclusion rules.
The first rule excludes specific web sites from being decrypted and uses two
lists: a local list where you can add web sites to exclude and a list managed by
Sophos of web sites where we know SSL inspection causes problems. An example of
when this may happen is when there is mutual authentication by the server and
client application. These two lists of web sites can be viewed in
Protect> Web > URL groups and in the case of the local TLS exclusion list
you can edit it. The second rule excludes by application
as identified by synchronized application control. From the top of the
SSL TLS inspection rules tab you can open the SSL TLS inspection settings.
These are generic engine based settings that will apply globally to all of the
rules. There are three sections here: the certificate authorities to use for
resigning RSA and EC certificates have the handle non-decryptable traffic, this
is either unsecure traffic that is not supported by SSL or TLS encryption, or
what to do if the HT firewall reaches its connection limit, and TLS 1.3
compatibility. TLS 1.3 is still fairly new and not widely adopted so there is
an option either to decrypt as TLS 1.3 or to downgrade to TLS 1.2. Before we
look at how to configure the rules themselves, we will look at the
decryption profiles that drive the behavior of the rules. These are located
in profiles > decryption profiles. Decryption profiles are a collection of
settings that are applied on a rule by rule basis. There are three different
decryption profiles provided: maximum compatibility, this is the most relaxed
profile and is focused on trying to ensure restrictions do not cause any
unexpected problems. Blocking secure, this blocks no weak protocols and ciphers, and
strict compliance is for people who need to meet more strict compliance standards
such as PCI. You can also create your own custom decryption profiles either from
scratch or by cloning an existing profile. There are three main sections to
profile: re signing certificate authority, which can either use the CA's defined in
the SSL TLS settings or they can be overridden. Non-decryptable traffic
where you could specify a different set of actions from the SSL TLS settings, and
enforcement rules, where you can plot specific protocols ciphers and
certificate errors. These can be used to enforce security settings to meet
compliance criteria. Now let's take a look at how you would configure a TLS
rule. ssl/tls inspection rules can be
configured to decrypt match traffic when you want to scan all the contents, not to
decrypt match traffic when it will cause problems with the site or application, or
to deny the matched to traffic. Select the decryption profile you want to use to
derive the behavior of this rule, and finally select matching criteria for the
rule, which is the same as for the firewall rules with the addition of
being able to match on categories and websites, and synchronize some security
identified applications. In summary configuring TLS inspection rules is done
in three stages: configure the global TLS inspection engine settings, customize the
decryption profiles to meet your requirements, and create the TLS rules to
decrypt the traffic. Remember for web traffic on port 80 and 443 the web proxy
needs to be disabled in the firewall rule for the new DPR engine and TLS
inspection rules to be used. Thanks for watching.