SSL Inspection Step-by-Step Guide. June 6, 2016

June 6, 2016

SSL Inspection

Eliminate blind spots of SSL encrypted communication to/from the enterprise

Maintaining information’s communication’s privacy

Compliance and regulatory need for information disclosure

– Log all information access details (what, who when and from where)

– Prevent unauthorized (source or destination) data communication

Prevent data leakage of business critical information

Prevent ingress of malware and advanced persistent threats

– through SSL encrypted channel

Monitor traffic to/from cloud applications and services

– Enforce the organization’s data privacy policies on cloud applications as well

Gain visibility on SSL traffic

• For inbound traffic, where the organization owns the SSL key

• For outbound traffic, where the organization doesn’t own the SSL key

Transparent traffic inspection

• Seamless

implementation, eliminating any user client reconfiguration • Enables traffic inspection

of various profiles (not just SSL traffic on port 443)

Support more than one security solution

• Enable security services chaining (e.g. DLP, anti-malware, instruction detection)

• Flexible security policies – per service, user profile etc.

• Minimal latency impact

Ensure high availability of connectivity

• Even when security solutions suffer from outages

Scalable solution

• Supporting security

solution scalability as well • Capable of supporting

Introducing Radware’s SSL Inspection Solution

WAN

Perimeter

LAN

Security Appliances

(i.e. DLP) Client facing

SSL handshake

(server emulation)

Server facing SSL handshake

(client emulation)

Transparently Intercept target data flows and decrypt SSL traffic

Steer traffic to security appliances

Transparent Proxy device

– One leg IPS deployment mode

– Usually used for application level protection

• Anti virus, anti bot, anti malware, WAF

– HTTPS traffic from client is decrypted and forwarded to VAS – VAS configured in L3 for IPS analysis

No-MAC (bridge) device

– Two leg IPS deployment mode

– Usually used for network level protection – Anti DDoS

– HTTPS traffic from client is decrypted and forwarded to VAS – VAS is configured as transparent L2

(no IP connectivity from Alteon to VAS)

SSL inspection demo setup

Web Server

– VLAN 100, Alteon port 3

Client PC

– VLAN 101, Alteon port 5

VAS

– VLAN 111, Alteon port 8

Alteon v30.2.0 and up with SSL license activated

Note: For Web server please use any web server that you feel comfortable with using HTTPS To simulate VAS, please use any Linux based server with IP forwarding function enabled

SSL Inspection Lab Setup

1.

Set IP interfaces and VLANs for Web server, Client and VAS

2.

Set frontend and backend SSL policies

3.

Set real server for VAS and assign to server group

4.

Create filter “redirect” from client to VAS

5.

Create filter “allow” from VAS to Server

6.

Enable filters on client/server/VAS ports (port processing)

7.

Create new certificate for SSL inspection

8.

Load the certificate to the client’s browser trusted CA certificate

1. Set IP and VLAN for Interfaces

interfaces

• Set Interfaces for Client, Server and VAS • Set IP address for the interfaces

2. Frontend SSL Policy Configuration

• Configure SSL policy for frontend SSL traffic from local clients to Alteon

2. Frontend SSL Policy Configuration

2. Backend SSL Policy Configuration

• Configure SSL policy for Backend SSL traffic

2. Backend SSL Policy Configuration

• Configure the Backend SSL – this is the outbound traffic that need to be re-encrypted after inspected by the VAS • Set Backend SSL Encryption to – Enable

3. Configure Real Server for VAS

3. Configure Real Server for VAS

4. Filter from Client to VAS

Match Settings:

• This filter will detect any HTTPS traffic coming from the client on port 443 and redirect it to the VAS

• Create new filter • Set Action – Redirect

• Set Protocol – TCP and Application HTTP • Set destination parameters –

• IP address/Network – Any • Mask – 0.0.0.0

4. Filter from Client to VAS

• Set Delayed Bind – Forceproxy • Set Real Server Port – 80

• Set Return to Last Hop – Enable • Set Reverse Session – Enable

4. Filter from Client to VAS

• Set SSL inspection – Enable

5. Filter from VAS to Web Server

Match Settings:

• This filter will detect the HTTP traffic coming from the VAS on port 80 and will encrypt it to be set to the Web server as HTTPS

• Create new filter • Set Action – Allow

• Set Protocol – TCP and Application HTTP • Set destination parameters –

• IP address/Network – Any • Mask – 0.0.0.0

5. Filter from VAS to Web Server

• Set Delayed Bind – Forceproxy • Set Real Server Port – 443

5. Filter from VAS to Web Server

• SSL Inspection – Enable

6. Port Processing Configuration

• Enable Filter/Outbound LLB • Add the “Client to VAS” filter

VAS Port Processing:

• Enable Filter/Outbound LLB • Add the “VAS to Server” filter

Server Port Processing:

• Enable Filter/Outbound LLB

7. New Certificate For Inspection

For SSL inspection to operate there is a need for CA certificate with a known private key, such as a self- signed CA certificate generated on Alteon. It will be used for signing dynamically dummy certificates

7. New Certificate For Inspection

7. New Certificate For Inspection

• Select the Key which defined in previous step • Select the Signing CA Certificate which defined in

8. Client Certificate Settings

Under SSL configuration

• Export the certificate to a file

8. Client Certificate Settings

Under control panel

Internet Options  Content  Certificates

Select Trusted Root Certification

Authorities  Import

8. Client Certificate Settings

• Options  Advanced

• Certificates  View certificates • Authorities  Import

Dummy VAS Configuration

In order for traffic to be forwarded to VAS and back to the server, a Linux based

server can be used to simulate VAS

Configure the Linux server to forward (simulate router functionality), all incoming

traffic back to Alteon

Check SSL Inspection

Check SSL Inspection

Open the secure connection info

Check SSL Inspection

SSL inspection demo setup

Web Server

– VLAN 100, Alteon port 3

Client PC

– VLAN 101, Alteon port 5

VAS

– Ingress traffic – VLAN 222, Alteon port 7, IP: 3.3.3.3

– Egress traffic – VLAN 333, Alteon port 9, IP: 4.4.4.4

Alteon v30.2.0 and up with SSL license activated

SSL Inspection – IPS Mode

IP Interface for VAS Traffic

ingress traffic

In this deployment mode

user’s decrypted traffic is sent between two Alteon ports where the VAS is listening and inspect the traffic.

Need to setup “dummy”

interfaces to pass the traffic • Set interface ID

• Set IP address, mask and VLAN

Create Dummy Real Server for VAS traffic

Create Dummy Real Server for VAS traffic

Create Real Server Group

• Create real server group

• assign ingress VAS real server created

Create new Health Check

• Create new logical expression health check based on ARP and Link to

Create Real Server Group

Add Static ARP

Port Processing Configuration

• Enable filter on Client port #5 • Select “client to VAS” filter which

Port Processing Configuration

Port Processing Configuration