Create a rule-based decryption policy with inbound connection protection

This task creates a decryption policy that protects inbound connections using either a Decrypt - Known Key rule action.

This task discusses how to create a decryption policy with a rule that protects inbound connections; that is, the destination server is inside your protected network. This type of rule has a Decrypt - Known Key rule action.

When you create a decryption policy, you can create multiple rules at the same time, including multiple Decrypt - Known Key rules and multiple Decrypt - Resign rules.

Before you begin

You must upload an internal certificate for your internal server before you can create a decryption policy that protects inbound connections. You can do this in any of the following ways:

  • Create an internal certificate object by going to Objects > PKI > Internal Certs and referring to PKI objects.

  • At the time you create this decryption policy.

If you enabled Change Management, you must create and assign a ticket before you can create a decryption policy. Before the decryption policy can be used, the ticket and all associated objects (like certificate authorities) must be approved. For more information, see Create change management tickets and Policies and objects that support change management.

Follow these steps to create a decryption policy with inbound connection protection:

Procedure

Step 1

Log in to Security Cloud Control if you haven't already done so.

Step 2

Click Tools & Services > Firewall Management Center > Policies > Access Control > Decryption.

Step 3

Click Create Decryption Policy.

Step 4

Perform these steps:

  1. Give the policy a unique Name and, optionally, a Description.

    The following characters are not supported in decryption policy names:

    • Leading period

    • #,;,{,},=,$,<,>

  2. From the Internal Certificates list, upload or choose certificates for the rules.

    For more information about internal CA certificates, see Internal certificate authority objects.

  3. (Optional.) Choose networks and ports.

    For more information:

  4. Click the Inbound Connections tab.

    Your decryption policy can cover outbound servers with a Decrypt - Resign rule or inbound servers with a Decrypt - Known Key rule.

  5. Click Next.

Step 5

Continue with Configure Rule-based decryption policy exclusions.

Step 6

Click Save.

What to do next