© 2015 Blue Coat Systems, Inc. All rights reserved. BLUE COAT, PROXYSG, PACKETSHAPER, CACHEFLOW, INTELLIGENCECENTER, CACHEOS, CACHEPULSE, CROSSBEAM, K9, DRTR, MACH5, PACKETWISE, POLICYCENTER, PROXYAV, PROXYCLIENT, SGOS, WEBPULSE, SOLERA NETWORKS, DEEPSEE, DS
APPLIANCE, SEE EVERYTHING. KNOW EVERYTHING., SECURITY EMPOWERS BUSINESS, BLUETOUCH, the Blue Coat shield, K9, and Solera Networks logos and other Blue Coat logos are registered trademarks or trademarks of Blue Coat Systems, Inc. or its affiliates in the U.S. and certain other countries. This list may not be complete, and the absence of a trademark from this list does not mean it is not a trademark of Blue Coat or that Blue Coat has stopped using the trade-mark. All other trademarks mentioned in this document owned by third parties are the property of their respective owners. This document is for informational purposes only.
BLUE COAT MAKES NO WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. BLUE COAT PRODUCTS, TECHNICAL SERVICES, AND ANY OTHER TECHNICAL DATA REFERENCED IN THIS DOCUMENT ARE SUBJECT TO U.S. EXPORT CONTROL AND SANCTIONS LAWS, REGULATIONS AND REQUIREMENTS, AND MAY BE SUBJECT TO EXPORT OR IMPORT REGULATIONS IN OTHER COUNTRIES. YOU AGREE TO COMPLY STRICTLY WITH THESE LAWS, REGULATIONS AND
REQUIREMENTS, AND ACKNOWLEDGE THAT YOU HAVE THE RESPONSIBILITY TO OBTAIN ANY LICENSES, PERMITS OR OTHER APPROVALS THAT MAY BE REQUIRED IN ORDER TO EXPORT, RE-EXPORT, TRANSFER IN COUNTRY OR IMPORT AFTER DELIVERY TO YOU.
Americas:
Blue Coat Systems, Inc. 420 N. Mary Ave.
Sunnyvale, CA 94085
Rest of the World:
Blue Coat Systems International SARL 3a Route des Arsenaux
1700 Fribourg, Switzerland
Table of Contents
Table of Contents
3
Decrypt Inbound SSL Traffic for Passive Security Device (D-H)
4
Passive-Inline Deployment Mode 4
Install SSL Visibility Appliance with Passive Security Device
5
Import Known Server Keys and Certificates
7
Export the Certificate and Private Key from the Internal SSL Server 7 Upload the Key and Certificate to the SSL Visibility Appliance 7
Create Rule to Test Installation
8
Create a Segment for Passive-Inline Mode
9
Add a Segment 9
Activate a Segment 9
Verify Installation (Inbound)
11
Create Rule to Test Decryption (Inbound)
12
Decrypt Inbound SSL Traffic for Passive Security Device (D-H)
Follow the steps below to set up the SSL Visibility Appliance to decrypt inbound SSL traffic, and send it, and all other traffic, to an attached passive security device. SSL servers are located inside the enterprise network, and their server keys and certificates can be uploaded to the SSL Visibility Appliance. The network uses the Diffie-Helman (D-H) key exchange method.Passive-Inline Deployment Mode
1. Install the SSL Visibility Appliance into the network. See "Install SSL Visibility Appliance with Passive Security Device" on the next page.
2. Download the known server keys and certificates from internal servers and upload them to the SSL Visibility Appliance. See "Import Known Server Keys and Certificates" on page 7.
3. Create a ruleset with a catch all action of cut through. See "Create Rule to Test Installation" on page 8. 4. Create a segment for Passive-Inline mode. See "Create a Segment for Passive-Inline Mode" on page 9. 5. Test/verify that the SSL Visibility Appliance is not blocking traffic. Show the results via SSL Session log. See
"Verify Installation (Inbound)" on page 11.
6. Create a rule to decrypt everything from a specific source IP (your laptop). "Create Rule to Test Decryption (Inbound)" on page 12.
7. Use the SSL Session Log to verify that the SSL Visibility Appliance is decrypting properly. See "Verify Decryption" on page 13.
Install SSL Visibility Appliance with Passive Security Device
To install the SSL Visibility Appliance with a passive security device in your network, follow the steps below.Network diagram before SSL Visibility Appliance
Network diagram after installing SSL Visibility Appliance
Tip: For details about initial configuration and licensing of the SSL Visibility Appliance, refer to theQuick Start Guide that came with your appliance.
1. Connect the Management port on the SSL Visibility Appliance to your management network. 2. Connect port 1 on the SSL Visibility Appliance to your LAN switch.
3. Connect port 2 to the firewall or router.
Import Known Server Keys and Certificates
To inspect inbound traffic to an internal SSL server, you export a copy of the server's SSL certificate and private key and upload them to the SSL Visibility Appliance. You import known server certificates and keys into the all-known-certificates-with-keys list.
Export the Certificate and Private Key from the Internal SSL Server
On your internal SSL server, you need to export the certificate and its private key in one of the following supported formats: PEM, PKCS#8, DER, PKCS#12. Make sure to use a strong password to ensure that the private key is well protected.
Caution: You must export the private key along with your certificate for it to be valid on the SSL Visibility Appliance.
Upload the Key and Certificate to the SSL Visibility Appliance
Make sure the exported certificate and key files are in a location the SSL Visibility Appliance can access. 1. Select PKI > Known Certificates and Keys.
2. In theKnown Certificates with Keys Listspanel, click the all-knowncertificates-with-keys entry.
3. In the panel below,Known Certificates with Keys, click Add . The Add Known Certificate with Key window displays.
4. Specify the files to import and enter the password you created when exporting the certificate.
Note: If you have a single file (such as a .pfx file) that contains both the certificate and private key, you only need to import the certificate file. The SSL Visibility Appliance will recognize that the private key is included and will not require you to import it separately.
5. Click Add.
If the key and certificate are valid, you will see a message confirming that the certificate has been added. The key displays as a row in theKnown Certificates with Keyspanel.
6. Apply the PKI Changes.
Create Rule to Test Installation
To make sure your SSL Visibility Appliance is connected and configured properly, you should create a basic ruleset that tests that traffic isn't getting blocked. To perform this test, create a ruleset with a Catch All Action of Cut Through.
1. Select Policies > Rulesets.
2. In theRulesetspanel, click the Add icon.
3. In the Add Ruleset window, enter a name for the ruleset and click OK. 4. In theRuleset Optionspanel, click the Edit icon.show screen...
5. Confirm that the Catch All Action is Cut Through. 6. Apply the Policy Changes.
Create a Segment for Passive-Inline Mode
Note: Before you create the segment, make sure you have determined your deployment mode and created a ruleset for the segment.
There are two steps to creating a segment: adding and activating.
Add a Segment
1. Select Policies > Segments. 2. Click the Add icon.
3. Click Edit to select the Mode of Operation. 4. For Mode of Operation, choose Passive Inline:
5. Click OK.
6. Select the Ruleset you previously created. 7. Choose the desired Session Log Mode.
8. Enter a brief description of the segment in the Comments box. 9. Click OK. The new segment appears in theSegmentspanel. 10. Apply the Policy Changes.
Activate a Segment
1. Select Policies > Segments.
2. In theSegmentspanel, select the segment to activate.
During segment activation, a series of screens appear that allow you to select the ports to be used for the segment, and to select any copy ports and the modes in which the copy ports will operate. Connect any copy ports to your passive security devices (for example, Security Analytics or an IDS). More on copy ports...1
4. Follow the prompts. Once the segment is active, the system dashboard displays a green background for the segment, and there are entries under Main Interfaces and Copy Interfaces (if applicable to your deployment). 5. Apply the Policy Changes.
Next Step:
"Verify Installation (Inbound)" on the next page
Verify Installation (Inbound)
To test and verify that the SSL Visibility Appliance is not blocking traffic, you can view the on-box SSL Session Log. 1. Access the inside SSL servers you imported certificates for.
2. Is all traffic being blocked? If so, your SSL Visibility Appliance may not be connected properly to the network. Review the steps for your deployment mode.
3. To see a list of recent SSL sessions, select Monitor > SSL Session Log.
4. Look for the domains of the servers you accessed, and observe the value in the Action column. Since the initial rule you created cuts through all traffic, the Action should say Cut Through for all sessions.
Create Rule to Test Decryption (Inbound)
To test that the SSL Visibility Appliance is decrypting SSL traffic, add a rule that decrypts everything from a specific source IP (your laptop).
1. Select Policies > Rulesets.
2. In theRulesetspanel, select the ruleset you previously created.
3. In theRulespanel, click the Insert icon to add a new rule. The Insert Rule dialog displays. 4. For Action, select Decrypt (Certificate and Key Known).
5. Select one of the following:
If you imported just one certificate, select Known Certificate with Key and choose the certificate you imported. or
If you imported multiple certificates, select Known Certificates with Keys and All Known Certificates with Keys 6. For Source IP, enter the IP address of your computer.
7. Click OK.
8. Apply the Policy Changes.
Verify Decryption
To test and verify that the SSL Visibility Appliance is decrypting traffic according to the rules you created, you can view the SSL Session Log.
1. Access a variety of websites or internal SSL servers. If you have created policies for specific host categories, domains, IP addresses, and so forth, make sure to go to websites that test these policies.
2. To see a list of recent SSL sessions, select Monitor > SSL Session Log.
3. Look for the domains of the websites/servers you visited, and observe the value in the Action column. Is the value you expected listed? For example, if you wanted the SSL Visibility Appliancenotto decrypt a particular type of traffic, does the Action say Cut Through? For sessions you wanted to be decrypted, does the Action say Decrypt? If you see unexpected values, review your policies.
Note: When a session is decrypted, the Action column will show eitherResign Certificate(if the deployment is using the certificate resigning method) orCertificate and Key Known(if you have imported known certificates and keys).
