SSL Decryption with Cisco Firepower Management Center

Cisco Firepower Management Center v6.2 
SSL Decryption Policy

This walk-through assumes you have an internal CA server in your production environment (e.g. Microsoft).

1. Login to Firepower Management Center (FPMC), go to Objects->Object Management->PKI->Internal CA's and click "Generate CA" 























2. Fill out each field according to your FPMC setup and click on "Generate CSR"























3. Copy the encrypted information from the certificate signing request, this can also be referred to as a base64 or .pem request. Now open a browser and access your internal certificate server and request a certificate.









4. Click on "Request a certificate", then click on "advanced certificate request"












5. Paste the content of the clipboard to the text box, Certificate Template should be selected as "Subordinate Certificate Authority" and click Submit.









6. Select Base64 encoded and click Download Certificate, save the signed certificate to a location easily accessible (e.g. Desktop). Open the cert with a text editor, copy all of the contents to the clipboard. We then go back into FPMC, edit our CSR, click Install Certificate, paste the contents of the clipboard and click "Save"
































7. The certificate is now signed and installed and FPMC now has the ability to resign certificates.







8. Now it is time to build your SSL Policy, go to Policies->Access Control->SSL. Click "New Policy". The following is an example of a typical SSL Policy wherein companies will refrain from decrypting Financial (e.g. Online Banking), Shopping (e.g. Amazon), and HealthCare Services (e.g. Cigna, BCBS) but then decrypt (resign) all remaining traffic (via the Default Decrypt All Rule).


9. Now, you will apply the SSL Policy by going to Policies->Access Control. Edit your existing access control policy, click on SSL Policy, from the drop down select your SSL Policy, Save and deploy to device/s.

This concludes the setup and creation of SSL Decryption on Firepower Management Center. It is important to note that while SSL Decryption is rather straight forward to implement, once you begin subjecting production traffic to SSL Decryption, you will likely need to make some adjustments, monitor connection events (Analysis->Connections->Events) to help you tune the SSL Policy to your companies needs. If something is being blocked (e.g. Google Services), you may want to add a new rule and add "Search Engines" category not be decrypted etc.















































Comments

Post a Comment

Popular posts from this blog

SSL Decryption with Palo Alto NGFW

Image
Palo Alto Networks Firewall v8.0.4 SSL Decryption Policy This walk-through assumes you have an internal CA server in your production environment (e.g. Microsoft). 1. Go to the Device Tab->Certficates. Lets import our CA certificate from the Microsoft Internal CA Server (e.g. http://x.x.x.x/certsrv). Click "Download a CA certificate, certificate chain, or CRL", choose Base64 and click "Download CA Certificate". Save this to an accessible location (e.g. Desktop) so it can be imported into the PAN-FW. 2. Back in the PAN GUI, import the CA cert and give it a comprehensive name (Note: You would click "Shared" if configuring this via Panorama and if you would like this cert to be used by multiple device/s. In this instance, we are configuring on a single local Firewall). Click ok!   Note: Click on the new Domain-RootCA cert, put a check mark next to "Trusted CA" and click ok! You will now see this reflected under the "
Read more

Cisco Firepower Management Center v6.2 - Reference Guide

Image
Firepower Management Center v6.2 Reference Guide While I have delivered Cisco Firepower to customers over the last several years, I always prefer that my customers are engaged and shadowing me as I install, configure, and tune Firepower. I am more than happy to explain as I go along however after Firepower is up and running I like to leave my customers with a reference guide that can help them better understand their new best of class NGIPS solution. I would like to share with you an example of this reference guide and I hope that it helps you better understand some partcular features or functions within Firepower Management Center, in this case v6.2. Once we understand the underlying features and functions, we can better configure and thereby tune the NGIPS so we can achieve the highly touted efficacy of the product in terms of detecting and preventing threats! Lets start at the beginning: Initial Configuration Steps - Definitions and HowTo Network Discovery Polic
Read more