SSL Inspection Step-by-Step Guide. June 6, 2016

Transcription

1 SSL Inspection Step-by-Step Guide June 6, 2016

2 Key Drivers for Inspecting Outbound SSL Traffic Eliminate blind spots of SSL encrypted communication to/from the enterprise Maintaining information s communication s privacy Compliance and regulatory need for information disclosure Log all information access details (what, who when and from where) Prevent unauthorized (source or destination) data communication Prevent data leakage of business critical information Prevent ingress of malware and advanced persistent threats through SSL encrypted channel Monitor traffic to/from cloud applications and services Enforce the organization s data privacy policies on cloud applications as well

3 Challenges & Requirements Gain visibility on SSL traffic For inbound traffic, where the organization owns the SSL key For outbound traffic, where the organization doesn t own the SSL key Transparent traffic inspection Seamless implementation, eliminating any user client reconfiguration Enables traffic inspection of various profiles (not just SSL traffic on port 443) Support more than one security solution Enable security services chaining (e.g. DLP, antimalware, instruction detection) Flexible security policies per service, user profile etc. Minimal latency impact Ensure high availability of connectivity Even when security solutions suffer from outages Scalable solution Supporting security solution scalability as well Capable of supporting multi-gig of SSL traffic

4 Introducing Radware s SSL Inspection Solution WAN Perimeter LAN Server facing SSL handshake (client emulation) Steer traffic to security appliances Security Appliances (i.e. DLP) Client facing SSL handshake (server emulation) Re-encrypt traffic, to maintain privacy Transparently Intercept target data flows and decrypt SSL traffic

5 SSL Inspection Deployment Modes Transparent Proxy device One leg IPS deployment mode Usually used for application level protection Anti virus, anti bot, anti malware, WAF HTTPS traffic from client is decrypted and forwarded to VAS VAS configured in L3 for IPS analysis No-MAC (bridge) device Two leg IPS deployment mode Usually used for network level protection Anti DDoS HTTPS traffic from client is decrypted and forwarded to VAS VAS is configured as transparent L2 (no IP connectivity from Alteon to VAS)

6 SSL Inspection Lab Setup SSL inspection demo setup Web Server VLAN 100, Alteon port 3 Client PC VLAN 101, Alteon port 5 VAS VLAN 111, Alteon port 8 Alteon v and up with SSL license activated Note: For Web server please use any web server that you feel comfortable with using HTTPS Web Server IP: GW: VAS IP: GW: Client IP: GW: To simulate VAS, please use any Linux based server with IP forwarding function enabled

7 Configuration Steps 1. Set IP interfaces and VLANs for Web server, Client and VAS 2. Set frontend and backend SSL policies 3. Set real server for VAS and assign to server group 4. Create filter redirect from client to VAS 5. Create filter allow from VAS to Server 6. Enable filters on client/server/vas ports (port processing) 7. Create new certificate for SSL inspection 8. Load the certificate to the client s browser trusted CA certificate

8 1. Set IP and VLAN for Interfaces Configure IP address and VLAN for all interfaces Set Interfaces for Client, Server and VAS Set IP address for the interfaces Set VLAN for each interface

9 2. Frontend SSL Policy Configuration 2.1 Frontend SSL policy configuration Configure SSL policy for frontend SSL traffic from local clients to Alteon Frontend SSL Encryption Enable

10 2. Frontend SSL Policy Configuration 2.2 Disable backend SSL Disable Backend SSL (forwarded to the VAS for inspection)

11 2. Backend SSL Policy Configuration 2.3 Backend SSL policy configuration Configure SSL policy for Backend SSL traffic Disable the Frontend SSL Encryption traffic coming from the VAS after inspection and need to be encrypted again Disable frontend SSL

12 2. Backend SSL Policy Configuration 2.4 Backend SSL policy configuration Configure the Backend SSL this is the outbound traffic that need to be re-encrypted after inspected by the VAS Set Backend SSL Encryption to Enable Set the SSL ciphers and allowed SSL/TLS versions

13 3. Configure Real Server for VAS 3.1 Create Real Server Create Real server and set the IP address

14 3. Configure Real Server for VAS 3.2 Create Real Server Group Create Real server group and assign the created real server to the group

15 4. Filter from Client to VAS 4.1 Create redirect filter from client to the VAS Match Settings: This filter will detect any HTTPS traffic coming from the client on port 443 and redirect it to the VAS Create new filter Set Action Redirect Set Protocol TCP and Application HTTP Set destination parameters IP address/network Any Mask Application port/range start 443 Application port/range End 443

16 4.2 Action Setting 4. Filter from Client to VAS Set Delayed Bind Forceproxy Set Real Server Port 80 Set Return to Last Hop Enable Set Reverse Session Enable Set Hash Based Group Metrics Both

17 4.3 SSL settings 4. Filter from Client to VAS Set SSL inspection Enable Set SSL Policy Select the frontend SSL policy created in step 2

18 5. Filter from VAS to Web Server 5.1 Create filter from VAS to Web Server Match Settings: This filter will detect the HTTP traffic coming from the VAS on port 80 and will encrypt it to be set to the Web server as HTTPS Create new filter Set Action Allow Set Protocol TCP and Application HTTP Set destination parameters IP address/network Any Mask Application port/range start 80 Application port/range End 80

19 5.2 Action Setting 5. Filter from VAS to Web Server Set Delayed Bind Forceproxy Set Real Server Port 443 Set Return to Last Hop Enable Set Reverse Session Enable

20 5.3 SSL settings 5. Filter from VAS to Web Server SSL Inspection Enable Select the Backend SSL policy created in step 2

21 6. Port Processing Configuration Client Port Processing: Enable Filter/Outbound LLB Add the Client to VAS filter VAS Port Processing: Enable Filter/Outbound LLB Add the VAS to Server filter Server Port Processing: Enable Filter/Outbound LLB VAS Port Processing Client Port Processing

22 6. Port Processing Configuration Summary Table

23 7. New Certificate For Inspection 7.1 Create new certificate repository entry For SSL inspection to operate there is a need for CA certificate with a known private key, such as a selfsigned CA certificate generated on Alteon. It will be used for signing dynamically dummy certificates Set the Certificate ID Set the common name

24 7. New Certificate For Inspection 7.2 Generate the certificate Generate the certificate

25 7. Certificate Repository Outcome

26 7. New Certificate For Inspection 7.3 Set the SSL Inspection parameters Select the Key which defined in previous step Select the Signing CA Certificate which defined in previous step

27 8. Client Certificate Settings 8.1 Export certificate Under SSL configuration Export the certificate to a file Load the certificate to the client s browser trusted CA certificate

28 8. Client Certificate Settings 8.2 Add certificate to client s PC Under control panel Internet Options Content Certificates Select Trusted Root Certification Authorities Import The settings is applicable for IE and Chrome

29 8. Client Certificate Settings 8.3 Upload certificate in FireFox Options Advanced Certificates View certificates Authorities Import Select the inspection certificate created previously

30 Dummy VAS Configuration In order for traffic to be forwarded to VAS and back to the server, a Linux based server can be used to simulate VAS Configure the Linux server to forward (simulate router functionality), all incoming traffic back to Alteon Use the command sysctl -w net.ipv4.ip_forward=1 to enable IP forwarding

31 Check SSL Inspection Connect to the web application From the client s browser, connect to the web server (

32 Check SSL Inspection Open the secure connection info Select More Information

33 Check SSL Inspection The Issued By filed is now based on the CN and Organization of the inspection certificate generated by Alteon and configured as the Signing CA Certificate

34 SSL Inspection No MAC Device Two Leg IPS Mode

35 SSL Inspection IPS Mode SSL inspection demo setup Web Server VLAN 100, Alteon port 3 Client PC VLAN 101, Alteon port 5 VAS Ingress traffic VLAN 222, Alteon port 7, IP: Egress traffic VLAN 333, Alteon port 9, IP: Alteon v and up with SSL license activated VAS Web Server IP: GW: Client IP: GW:

36 IP Interface for VAS Traffic Set IP interface for VAS ingress traffic In this deployment mode user s decrypted traffic is sent between two Alteon ports where the VAS is listening and inspect the traffic. Need to setup dummy interfaces to pass the traffic Set interface ID Set IP address, mask and VLAN VAS ingress traffic VAS egress traffic

37 Create Dummy Real Server for VAS traffic Create real server for ingress VAS traffic Under IDS set specific port for which all traffic will be forwarded

38 Create Dummy Real Server for VAS traffic Create real server for egress VAS traffic Under IDS set specific port for which all traffic will be forwarded

39 Create Real Server Group Create real server group assign ingress VAS real server created previously

40 Create new Health Check Create new logical expression health check based on ARP and Link to monitor the VAS links

41 Create Real Server Group Assign the ARP&Link Health check to the server group

42 Add Static ARP Add static ARP to enable Alteon to pass traffic from ingress VAS port 7 to egress VAS port 9 by adding static ARP of the dummy real server using Alteon MAC address

43 Port Processing Configuration Enable filter on Client port #5 Select client to VAS filter which redirect all HTTPS traffic to the VAS

44 Port Processing Configuration Enable filter on ingress VAS port #7

45 Port Processing Configuration Enable filter on egress VAS port #9 Select VAS to server filter

46