Palo Alto SSL Forward Proxy

What is SSL Forward Proxy?

An SSL Forward Proxy, also known as an SSL Inspection or Decryption Proxy, is a network security device that intercepts and inspects encrypted SSL/TLS traffic between a client and a web server on the internet. SSL Forward Proxy does a deep packet inspection and monitoring of encrypted network traffic for security, compliance, and policy enforcement reasons.

Importing Trusted Root CA

First download the Root-CA from the CA server

Then on Palo Alto, go to Device » Certificates » Import

And then select “Trusted Root CA”

Generating and Signing CSR

Next let’s generate a CSR for the Firewall, on the same page click Generate

CSR (Certificate Signing Request) is a message generated by a server to apply for a SSL/TLS certificate to the CA (Certificate Authority)

Export the CSR by selecting Export Certificate

Next Sign the CSR on the CA Server, use “Subordinate Certificate Authority” template

A Subordinate Certificate Authority (Sub-CA) is a lower-level entity in a PKI hierarchy, issuing certificates under the authority of a higher-level CA.

Import the Certificate to Palo Alto

Select the paloalto cert, select “Forward Trust Certificate” and “Forward Untrust Certificate”

And this is what we end up with

Creating Decryption Policy

First create a Decryption Profile, on Objects » Decryption Profile, create new
Here we create the rule of which connection should be allowed or not based on the target server’s certificate.

Next we create the Decryption Policy, on Policies » Decryption, create new

Give it a name

Select Inside Zone as the source

Select Outside Zone as the destination

Select Decrypt with the newly created Decryption Profile

Testing the SSL Forward Proxy

Before testing, make sure the machine on the inside network also trusts the Root CA

Now if we access anything on the internet, we’ll see the certificate issuer being the paloalto, meaning paloalto decrypts, inspects, and re-encrypts the traffic before it being forwarded to the actual destination

Looking at certificate hierarchy, we can see the PKI Heirarchy, where paloalto.helena.gg acts as a Sub-CA of HELENA-CA, issuing certificate for twitter.com

On the Decryption Policy, we can see the hit counter going up

On Monitor » Decryption, we can see all the decrypted traffic

Now if we try accessing sites with bad certificate, we should see a warning not allowing the access

On ACC » SSL Activity, we can see the overall SSL Decryption stats, as well as the sites that are not allowed to be accessed because of bad certificates