Welcome to the Cisco Secure Firewall Session TLS decryption. I am Lucashi Carollo and I'm a customer success specialist at Cisco. In this session.00:05I will cover TLS decryption overview and use cases and a final demo. Let's start with TLS decryption. TLS decryption.00:18Is the capability of Cisco secure Firewall to intercept and decrypt traffic that goes through the firepower device. Today, the majority of internet traffic is encrypted, and by default.00:33Cisco secured Firewall has NO visibility into this encrypted traffic. These limitations arises from how TLS works. The client establishes a secure connection directly with the, with the server.00:50And all data exchange in between is encrypted. Now, if traffic is encrypted, the firewall cannot inspect the payload which may contain malware or other threats.01:07To analyze and block malicious content, the firewall must have the visibility into the encrypted data. And TLS decryption addresses this issue. There are two main use cases for TLS decryption.01:241st TLS decryption with non key. This is used to protect servers in the DMZ from encrypted threats and these applies to inbound traffic. 2nd use case.01:41It's called TLS decryption with resigned option, and it is used to monitor users outbound traffic. I'll briefly explain each use case and then I will show you how to configure them in the demo lab.01:57When using TLS decryption with known key, we are protecting services that we own and control such as servers in the DMZ. In this slide.02:18We see how a remote client on the internet is sending data to a protected server which is located in the DMZ network. The HTTPS traffic is encrypted using the web server's public key.02:31As part of the TLS handshake, only the web server can decrypt this traffic using its private key. And as a result, at this point, the site power device.02:47Has NO visibility into the encrypted content. To implement TLS decryption with non key, we need to upload the web server certificate and private key into the FMC firepower management center.03:03If we do that, the firepower will intercept the encrypted traffic, it will decrypt using the server private key, it will inspect the payload and re encrypt the traffic and forward it to the destination server.03:20This provides full visibility without breaking the connection. 2nd use case is TLS decryption with resign, which applies traffic going from the internal network.03:37To the internet. In this scenario, we want to decrypt traffic from users who are accessing websites that we do not control. In this case, the firepower device.03:54Acts as a proxy. When it matches the relevant traffic, it resigns the original server certificate using a certificate authority certificate trusted by the internal client.04:10This creates two separate TLS sessions, one between the client and the fire power, and one between the fire power and the external server. This allows the fire power to decrypt, inspect, and re encrypt the traffic.04:26Without the client being aware, as long as the resigning CA is trusted by the client. The certificate authority resigning the server certificate.04:42Can be achieved either make the SMC a sub CA to the corporate CA. This is option one or by making the SMC a standalone CA that all clients trust.04:58The 1st option is the recommended one, as we assume the toll clients already trust the car the corporate CA. Let's now move to the demo. In this lab.05:16I'm going to show you how to implement both TLS decryption use cases. Let's start from the TLS decryption with non key use case. In this topology, we have a web server in the DMZ network on the bottom right.05:33Hosting a public website. We also have an external attacker which is located on the upper right part of the screen, and this client is sending malicious traffic to the web server.05:53To implement TLS decryption with non key, I will 1st need to create an object containing my web server certificate and private key. In my SMC, I will navigate to.06:11Objects, object management PKI, and then internal search. I already have an object created here.06:27Which contains my web server certificate and private key. But if I want to add a new one, I will click on add internal search. I will give it a name and I will upload the client certificate 1st.06:42And key second. I will then click on save. At this point, I am ready to create my SSL decryption policy with non key.07:01I will go to policies, SSL, and here I already have a category with a policy, with a rule that I already added. Let's take a look at how this rule works.07:19I already provided the name and the action is gonna be decryption with known key for my inbound traffic. And here I will have to select the object which is my web server certificate and private key, which I just created.07:39Then I will need to select the conditions for traffic to match this specific rule, and I will say that when my traffic will match this specific destination network on port HTTPS, I will do this action which is decrypted with non key.07:59I will enable logging and I will click on save. Now I need to link this SSL policy in my access control policy, so I will navigate to policies, access control.08:18And on my main access control policy, from the top right, I will need to select SSL policy, and from the dropdown menu, I will select the SSL policy which I have just created. We need to remember that the SSL policy is applied.08:36Globally and not per rule basically. Now, to complete this scenario, I just created the rule which is inspecting the traffic coming from the outside to my DMZ.08:55And here I have my intrusion policy configured. Let's now discuss 2nd use case. In this topology, we have users in our internal network.09:10On the bottom left, and they need to access the public internet. If users navigate to malicious websites or if they download malicious files or content, the secure firewall cannot inspect the encrypted traffic.09:28And maybe unable to block the packets. We need to implement TLS decryption with resigned option. I will go to my FMC and I will create a new object.09:45I will go on PKI and internal CA. I need to create a new sub CA, which will be my SMC. I already have this object created.10:04But for the goal of this video, I will show you how to generate a new one. I have to generate the certificate signing request and let them let it be signed by my internal CA. I will click on generate CA. I will give it a name.10:19Country and I will click on, generate CSR. Once I have the CSR, I will copy this CSR.10:40Go to my Active Directory certificate services, and I will click on request a certificate Advanced certificate template web server, and here I need to paste my CSR.10:58Generated by my FMC. As soon as they click generate, I can now download my FMC certificate. I can give it a name.11:15And at this point I need to upload this certificate into my SMC. Here I have my already created sub CA, but on this new object, if I click on edit.11:32I am ready to install the certificate which was signed by my internal CA. I can click on save, and I will have my object ready to be used.11:48At this point, I need to create my decryption rule, so I will go on policies SSL, edit, and I will create a new rule.12:09Which I will call TLS decryption resign. This is the name of my rule. The action this time is gonna be decryption with NO, with resign option and the object is the one that I have just created.12:23I will configure my condition and I will click on save. Just for the goal of this demo, I have created a rule to block PDF files.12:39For my users when they are going to the internet. This is my rule, and this is where I have applied the file policy called block PDFs. Let's now go and see what happens if we try to test.12:56This deployment. I will go to my unified events. I will click, I will filter by an event type.13:14Intrusion and I will click apply. I will now go to my malicious computer and from here I will start, I will simulate an attack.13:32Towards my web server. This is the SQUDN of my web server, which is host on my DMZ network. For this demo I will use Nicto.13:48Which is a web vulnerability scanner to do some scanning towards this domain. I will start the scanning and go back to my logs.14:08If everything is working correctly.14:34I should start seeing some intrusion events, which action would block because in my case I'm using the STD in IDS mode and not IPS mode. What I want to show you is that as soon as I expand this event.14:36The SSL status will be decryption with non key, which means that the traffic, even though it's encrypted over port 443, we were able to decrypt this traffic and to apply our intrusion policy.14:55I can also have more informations about this traffic by going to intrusion events and see in the classification for the packets which were inspected by the fire power. This is how we tested the 1st use case.15:16Let's now test 2nd use case. I have a workstation in my HQ inside network, and I will try to go and download a PDF file. Before to do that, I will go on my logs.15:36And I will try to filter based on my source AP. Now.15:56Now that I have logging enabled, I can go I can go on my workstation.16:16And try to go and download a PDF file. I want to download the PDF file on a web server which is protected by.16:21PLS, I see that my file was blocked and if I move back to my logs, I can see that the action was blocked for this file. As soon as I expand my event.16:38What is important is that the SSL status for this connection was decryption with resign. In this case, the traffic generated from my client was decrypted.16:55Inspected and then encrypted once again before being sent to my, to the external web server. What I can also notice is that if I go on the certificate for this web server.17:12I will notice that the FMC was the certificate authority which signed, which resigned the certificate from this web server. This is all.17:27Thank you for the attention.17:43
