Decrypt Inbound SSL
Traffic for Active Security
Device (FTA)
SSL Visibility Appliance First Steps Guide
Third Party Copyright Notices
© 2015 Blue Coat Systems, Inc. All rights reserved. BLUE COAT, PROXYSG, PACKETSHAPER, CACHEFLOW,
INTELLIGENCECENTER, CACHEOS, CACHEPULSE, CROSSBEAM, K9, DRTR, MACH5, PACKETWISE,
POLICYCENTER, PROXYAV, PROXYCLIENT, SGOS, WEBPULSE, SOLERA NETWORKS, DEEPSEE, DS
APPLIANCE, SEE EVERYTHING. KNOW EVERYTHING., SECURITY EMPOWERS BUSINESS, BLUETOUCH, the
Blue Coat shield, K9, and Solera Networks logos and other Blue Coat logos are registered trademarks or trademarks of Blue
Coat Systems, Inc. or its affiliates in the U.S. and certain other countries. This list may not be complete, and the absence of
a trademark from this list does not mean it is not a trademark of Blue Coat or that Blue Coat has stopped using the trademark. All other trademarks mentioned in this document owned by third parties are the property of their respective owners.
This document is for informational purposes only.
BLUE COAT MAKES NO WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION IN
THIS DOCUMENT. BLUE COAT PRODUCTS, TECHNICAL SERVICES, AND ANY OTHER TECHNICAL DATA
REFERENCED IN THIS DOCUMENT ARE SUBJECT TO U.S. EXPORT CONTROL AND SANCTIONS LAWS,
REGULATIONS AND REQUIREMENTS, AND MAY BE SUBJECT TO EXPORT OR IMPORT REGULATIONS IN
OTHER COUNTRIES. YOU AGREE TO COMPLY STRICTLY WITH THESE LAWS, REGULATIONS AND
REQUIREMENTS, AND ACKNOWLEDGE THAT YOU HAVE THE RESPONSIBILITY TO OBTAIN ANY LICENSES,
PERMITS OR OTHER APPROVALS THAT MAY BE REQUIRED IN ORDER TO EXPORT, RE-EXPORT, TRANSFER
IN COUNTRY OR IMPORT AFTER DELIVERY TO YOU.
Americas:
Blue Coat Systems, Inc.
420 N. Mary Ave.
Sunnyvale, CA 94085
Rest of the World:
Blue Coat Systems International SARL
3a Route des Arsenaux
1700 Fribourg, Switzerland
6/9/2015
Decrypt Inbound SSL Traffic for Active Security Device (FTA)
Table of Contents
Table of Contents
3
Decrypt Inbound SSL Traffic for Active Security Device (FTA)
4
Active-Inline FTA Deployment Mode
4
Install SSL Visibility Appliance with Active Security Device (FTA)
5
Import Known Server Keys and Certificates
6
Export the Certificate and Private Key from the Internal SSL Server
6
Upload the Key and Certificate to the SSL Visibility Appliance
6
Create Rule to Test Installation
7
Create a Segment for Active-Inline Mode
8
Add a Segment
8
Activate a Segment
9
Verify Installation (Inbound)
10
Create Rule to Test Decryption (Inbound)
11
Verify Decryption
12
3
Decrypt Inbound SSL Traffic for Active Security Device (FTA)
Decrypt Inbound SSL Traffic for Active Security Device (FTA)
Follow the steps below to set up the SSL Visibility Appliance to decrypt inbound SSL traffic, and send it, and all other
traffic, to an attached active security device. In this deployment, if the SSL Visibility Appliance loses power, traffic will
flow through the attached security device (fail-to-appliance). SSL servers are located inside the enterprise network, and
their server keys and certificates can be uploaded to the SSL Visibility Appliance.
Active-Inline FTA Deployment Mode
1. Install the SSL Visibility Appliance in the network. See "Install SSL Visibility Appliance with Active Security Device
(FTA)" on the next page.
2. Download the known server keys and certificates from internal servers and upload them to the SSL Visibility
Appliance. See "Import Known Server Keys and Certificates" on page 6.
3. Create a ruleset with a catch all action of cut through. See "Create Rule to Test Installation" on page 7.
4. Create a segment for Active-Inline FTA mode. See "Create a Segment for Active-Inline Mode" on page 8.
5. Test/verify that the SSL Visibility Appliance is not blocking traffic. Show the results via SSL Session log. See
"Verify Installation (Inbound)" on page 10.
6. Create a rule to decrypt everything from a specific source IP (your laptop). "Create Rule to Test Decryption
(Inbound)" on page 11.
7. Use the SSL Session Log to verify that the SSL Visibility Appliance is decrypting properly. See "Verify Decryption"
on page 12.
8. Delete the decryption testing rule, and create your own policies to define what traffic you want to decrypt, reject, or
drop.
4
Decrypt Inbound SSL Traffic for Active Security Device (FTA)
Install SSL Visibility Appliance with Active Security Device
(FTA)
To install the SSL Visibility Appliance with an active security device in your network, and ensure that traffic flows through
the attached security device in case the SSL Visibility Appliance loses power (fail-to-appliance), follow the steps below.
Network diagram before SSL Visibility Appliance
Network diagram after installing SSL Visibility Appliance
Tip: For details about initial configuration and licensing of the SSL Visibility Appliance, refer to the Quick Start Guide
that came with your appliance.
1. Connect the Management port on the SSL Visibility Appliance to your management network.
2. Connect port 1 on the SSL Visibility Appliance to your LAN switch.
3. Connect port 4 to the firewall or router.
4. Connect the security device to ports 2 and 3 on the SSL Visibility Appliance.
Next Step: "Import Known Server Keys and Certificates" on the next page
5
Decrypt Inbound SSL Traffic for Active Security Device (FTA)
Import Known Server Keys and Certificates
To inspect inbound traffic to an internal SSL server, you export a copy of the server's SSL certificate and private key and
upload them to the SSL Visibility Appliance. You import known server certificates and keys into the all-known-certificateswith-keys list.
Export the Certificate and Private Key from the Internal SSL Server
On your internal SSL server, you need to export the certificate and its private key in one of the following supported formats:
PEM, PKCS#8, DER, PKCS#12. Make sure to use a strong password to ensure that the private key is well protected.
Caution: You must export the private key along with your certificate for it to be valid on the SSL Visibility Appliance.
Upload the Key and Certificate to the SSL Visibility Appliance
Make sure the exported certificate and key files are in a location the SSL Visibility Appliance can access.
1. Select PKI > Known Certificates and Keys.
2. In the Known Certificates with Keys Lists panel, click the all-knowncertificates-with-keys entry.
3. In the panel below, Known Certificates with Keys, click Add
displays.
. The Add Known Certificate with Key window
4. Specify the files to import and enter the password you created when exporting the certificate.
Note: If you have a single file (such as a .pfx file) that contains both the certificate and private key, you only
need to import the certificate file. The SSL Visibility Appliance will recognize that the private key is included
and will not require you to import it separately.
5. Click Add.
If the key and certificate are valid, you will see a message confirming that the certificate has been added. The key
displays as a row in the Known Certificates with Keys panel.
6. Apply the PKI Changes.
Next Step: "Create Rule to Test Installation" on the next page
6
Decrypt Inbound SSL Traffic for Active Security Device (FTA)
Create Rule to Test Installation
To make sure your SSL Visibility Appliance is connected and configured properly, you should create a basic ruleset that
tests that traffic isn't getting blocked. To perform this test, create a ruleset with a Catch All Action of Cut Through.
1. Select Policies > Rulesets.
2. In the Rulesets panel, click the Add
icon.
3. In the Add Ruleset window, enter a name for the ruleset and click OK.
4. In the Ruleset Options panel, click the Edit
icon. show screen...
5. Confirm that the Catch All Action is Cut Through.
6. Apply the Policy Changes.
Next Step: "Create a Segment for Active-Inline Mode" on the next page
7
Decrypt Inbound SSL Traffic for Active Security Device (FTA)
Create a Segment for Active-Inline Mode
Note: Before you create the segment, make sure you have determined your deployment mode and created a ruleset
for the segment.
There are two steps to creating a segment: adding and activating.
Add a Segment
1. Select Policies > Segments.
2. Click the Add
icon.
3. Click Edit to select the Mode of Operation.
4. For Mode of Operation, choose the appropriate mode:
Active Inline, Fail to Appliance
or
Active Inline, Fail to Network.
5. Click OK.
6. Select the Ruleset you previously created.
7. Choose the desired Session Log Mode.
8. Enter a brief description of the segment in the Comments box.
9. Click OK. The new segment appears in the Segments panel.
10. Apply the Policy Changes.
8
Decrypt Inbound SSL Traffic for Active Security Device (FTA)
Activate a Segment
1. Select Policies > Segments.
2. In the Segments panel, select the segment to activate.
3. Click the Activate
icon. The Segment Activation window displays.
During segment activation, a series of screens appear that allow you to select the ports to be used for the segment,
and to select any copy ports and the modes in which the copy ports will operate. Connect any copy ports to your
passive security devices (for example, Security Analytics or an IDS). More on copy ports...1
4. Follow the prompts. Once the segment is active, the system dashboard displays a green background for the
segment, and there are entries under Main Interfaces and Copy Interfaces (if applicable to your deployment).
5. Apply the Policy Changes.
Next Step: Verify Installation (Outbound) or "Verify Installation (Inbound)" on the next page
1You may need more than one physical port to feed your passive device, depending on the amount of network
traffic. For example, if you have 1GB of traffic in each direction, you will need to connect two copy ports to the
security device, and decide whether you want to load balance or send all inbound traffic through one port and all
outbound traffic through another. Note that you can connect up to two passive devices to the SSL Visibility
Appliance and each device can connect to one or two copy ports.
9
Decrypt Inbound SSL Traffic for Active Security Device (FTA)
Verify Installation (Inbound)
To test and verify that the SSL Visibility Appliance is not blocking traffic, you can view the on-box SSL Session Log.
1. Access the inside SSL servers you imported certificates for.
2. Is all traffic being blocked? If so, your SSL Visibility Appliance may not be connected properly to the network.
Review the steps for your deployment mode.
3. To see a list of recent SSL sessions, select Monitor > SSL Session Log.
4. Look for the domains of the servers you accessed, and observe the value in the Action column. Since the initial rule
you created cuts through all traffic, the Action should say Cut Through for all sessions.
Next Step: "Create Rule to Test Decryption (Inbound)" on the next page
10
Decrypt Inbound SSL Traffic for Active Security Device (FTA)
Create Rule to Test Decryption (Inbound)
To test that the SSL Visibility Appliance is decrypting SSL traffic, add a rule that decrypts everything from a specific source
IP (your laptop).
1. Select Policies > Rulesets.
2. In the Rulesets panel, select the ruleset you previously created.
3. In the Rules panel, click the Insert
icon to add a new rule. The Insert Rule dialog displays.
4. For Action, select Decrypt (Certificate and Key Known).
5. Select one of the following:
If you imported just one certificate, select Known Certificate with Key and choose the certificate you imported.
or
If you imported multiple certificates, select Known Certificates with Keys and All Known Certificates with Keys
6. For Source IP, enter the IP address of your computer.
7. Click OK.
8. Apply the Policy Changes.
Next Step: "Verify Decryption" on the next page
11
Decrypt Inbound SSL Traffic for Active Security Device (FTA)
Verify Decryption
To test and verify that the SSL Visibility Appliance is decrypting traffic according to the rules you created, you can view the
SSL Session Log.
1. Access a variety of websites or internal SSL servers. If you have created policies for specific host categories,
domains, IP addresses, and so forth, make sure to go to websites that test these policies.
2. To see a list of recent SSL sessions, select Monitor > SSL Session Log.
3. Look for the domains of the websites/servers you visited, and observe the value in the Action column. Is the value
you expected listed? For example, if you wanted the SSL Visibility Appliancenot to decrypt a particular type of
traffic, does the Action say Cut Through? For sessions you wanted to be decrypted, does the Action say Decrypt?
If you see unexpected values, review your policies.
Note: When a session is decrypted, the Action column will show either Resign Certificate (if the deployment is
using the certificate resigning method) or Certificate and Key Known (if you have imported known certificates and
keys).
Final Step: Delete the decryption testing rule, and create your own policies to define
what traffic you want to decrypt, reject, or drop.
12