How do firewalls select cipher suites for SSL Forward Proxy decryption?

2281

Created On 06/16/23 11:58 AM - Last Modified 04/18/24 21:39 PM

Decryption Policy

SSL Forward Proxy

Decryption

9.1

10.2

10.1

11.1

11.0

PAN-OS

Next-Generation Firewall

Question

How do firewalls select cipher suites for use in proxied Client Hellos when performing SSL Decryption using the SSL Forward Proxy feature?

This is the flow that leads to cipher selection:

A client sends an SSL Client Hello which lists the ciphers it supports.
The firewall intercepts this Hello and prepares a new one.
The firewall compares the list of client supported ciphers with those configured in the Decryption Profile under SSL Decryption > SSL Protocol Settings.
1. Scenario 1: There are matches. The Firewall sends the new Client Hello with the ciphers that exist in both the Decryption Profile and the original Client Hello.
2. Scenario 2: There are no matches. The Firewall writes an error message to the decryption log and performs an action depending on the configuration in the Decryption Profile under SSL Decryption > SSL Forward Proxy > Unsupported Mode Checks > Block sessions with unsupported cipher suites.
  1. Box checked: Block the session.
  2. Box unchecked: Allow the session without decryption.

In summary, the firewall performs a logical AND on the ciphers in the Decryption Profile and the original Client Hello, and only includes those that return True in the proxied Client Hello.
The firewall will not offer cipher suites in the proxied Client Hello that did not exist in the original Client Hello.
It is therefore not possible to use the firewall to "upgrade" the security of a legacy client connection that only offers weak ciphers.