Palo Alto SSL Forward Proxy (Outbound SSL Decryption) [2024]

[@onurcan9129]

Thanks a lot for your clarifications

[@netsums]

You're welcome, I'm glad you liked the video. :)

[@Neur0bit]

fantastic explanation. thanks for all the effort you put into these videos.

[@robertoospina10]

Awesome

[@netsums]

Thank you, I'm glad you liked it. :-)

[@irvingcastro9971]

Hello, excellent explanation, my compliments. I would like to see that scenario with an enterprise CA or PKI. Thanks for sharing your knowledge.

[@netsums]

Hi. Thank you for the comment. :-) im glad you liked the video. I will keep your suggestion in mind for the next tutorials.

[@nxu5107]

Hi Thanks for this. What would happen if there are two firewalls in series, both wanting to decrypt the traffic?

[@netsums]

Hi. The second firewall will consider the first as a client (normal PC, just as a server doesn't know it's communicating with a firewall), and will show its certificate to the first firewall. I hope I could answer your question. :)

[@nxu5107]

@@netsums Thank you ever so much for your response. I thought along the same lines. Problem is one firewall will only allow us to export it's root CA cert the other is a Palo. We have to work out the logic to position the firewalls in a way to achieve our goals. Thanks again.

[@netsums]

In my opinion the Palo does a pretty good job identifying apps, like differenciating Google drive/docs uploads and downloads, for example. So I would tend to activate the ssl decryption only on the Palo and not on the other firewall, specially if you have the threat prevention license. But yes, it depends also on how the firewalls are setup in your environment.

[@baller15g]

Everyone fears this. It's always a nightmare to deploy.

[@netsums]

That's also my experience. Nowadays most companies need it, but it can be a pain for the administrators. And not all users are very understanding, when something that worked before suddenly stops working. 😊

[@priyajayswal6581]

Hey can you make video on how to do segmentation on firewall

[@netsums]

Hi. What do you mean exactly? Through zones? Or like using different virtual routers?

[@modibosissoko634]

Hello is this necessarily authorized to use ssl descryption in the network if yes what are the advantages and disadvantages.thx

[@netsums]

I'm not sure I understand your question. In some countries there are some connections that are not allowed to be decrypted. Each company has its own policies. The advantage of SSL decryption is that the firewall gains more visibility on the traffic.