Cisco FTD SSL Decryption
SSL decryption is the process of intercepting and decrypting web traffic by security appliances in order to inspect the content of the encrypted traffic for security purposes
Configuring Internal CA Certificate
First we need to create an Internal CA certificate, this certificate will be used as an issuer for the decrypted trafic.
For some reason, FTD is not able to create a CSR without FMC (Firepower Management Center), so we need to use the help of Certificate Tools to do that
Here fill in the Common Name, Subject Alternative Name, and etc as shown below
On Key Usage dropdown, make sure to check Certificate Sign and CRL Sign.
Leave everything empty for Extended Key Usage, and on Basic Constraint select yes for the CA option.
Go over to the CA Server, sign the CSR using the template “Subordinate Certificate Authority”
A Subordinate Certificate Authority (Sub-CA) is a lower-level entity in a PKI hierarchy, issuing certificates under the authority of a higher-level CA.
Then go to the Firewall Device Manager of FTD, on Objects » Certificate, add Internal CA.
Fill in the Signed Certificate from CA Server and Private key from Certification Tools
And the Internal CA is imported and ready to be used
Configuring SSL Decryption Policy
On Policies » SSL Decryption, select Enable SSL Decryption.
Use the newly imported Internal CA for the Decrypt Re-Sign Certificate, and add the Root CA as a Trusted CA Certificates.
For the rule, add new one named “decrypt-all” matching all traffic from inside zone to outside zone on port HTTP and HTTPS
And that’s it. We now have the SSL Decryption enabled with one rule.
Testing the SSL Decryption
On the client PC, when accessing any website on the internet we should see the certificates are now issued by our FTD Firewall, meaning the traffic indeed was decrypted and re-encrypted by FTD
Clicking the details hows more regarding the PKI Heirarchy, where ftd.helena.gg acts as a Sub-CA of HELENA-CA issuing certificate for twitter.com
Back on the Firewall, on Monitoring » Events, we can see all the traffic along with its SSL Certificate status
Clicking details shows a granular information regarding the traffic, especially the SSL decryption status
Blocking Traffic with Bad SSL
Right now we only have one rule that matches all traffic to the internet, let’s create another one that blocks all traffic with bad SSL certificates.
On Policies » SSL Decryption, add new rule named “block” with order “1”
On advanced, select Certificate Status of “Invalid” and Self Signed of “Self-Signing”, save it.
Now we have two rules for SSL Decryption
Testing the SSL Decryption with Block
Testing it again, now all the traffic with bad SSL will be blocked
And on Monitoring » Events, we can also see all the blocked traffic along with the Certificate Status
And lastly, we can see the overall stats of the SSL Decryption process on Monitoring » SSL Decryption
