Create a rule-based decryption policy with outbound connection protection

This task creates a decryption policy that protects outbound connections by intercepting and decrypting SSL/TLS traffic between internal clients and external servers, then re-encrypting the traffic with an internal CA certificate.

This task discusses how to create a decryption policy with a rule that protects outbound connections; that is, the destination server is outside your protected network. This type of rule has a Decrypt - Resign rule action.

When you create a decryption policy, you can create multiple rules at the same time, including multiple Decrypt - Known Key rules and multiple Decrypt - Resign rules.

If you enabled Change Management, you must create and assign a ticket before you can create a decryption policy. Before the decryption policy can be used, the ticket and all associated objects (like certificate authorities) must be approved. For more information, see Create change management tickets and Policies and objects that support change management.

Before you begin

You can optionally must upload or generate an internal CA certificate for your managed device before you can create a decryption policy that protects outbound connections. You can do this in any of the following ways:

  • Create an internal CA certificate object by going to Objects > PKI > Internal CAs and referring to PKI objects.

  • At the time you create this decryption policy.

Follow these steps to create a rule-based decryption policy with outbound connection protection:

Procedure

Step 1

Log in to Security Cloud Control if you haven't already done so.

Step 2

Click Administration > Integrations > Firewall Management Center and choose Policies > Access Control > Decryption.

Step 3

Click Create Decryption Policy.

Step 4

Give the policy a unique Name and, optionally, a Description.

The following characters are not supported in decryption policy names:

  • Leading period

  • #,;,{,},=,$,<,>

Step 5

Click the Outbound Connections tab.

Your decryption policy can cover outbound servers with a Decrypt - Resign rule or inbound servers with a Decrypt - Known Key rule. We create one decryption rule per combination of certificate and networks/ports, if any.

Your decryption policy can cover outbound servers with a Decrypt - Resign rule or inbound servers with a Decrypt - Known Key rule. We create one decryption rule per combination of certificate and networks/ports, if any.

Step 6

From the Internal CA list, upload or choose certificates for the rules.

For more information about internal certificates, see Generate an internal CA for outbound protection and Upload an internal CA for outbound protection.

  1. (Optional.) Choose networks and ports.

    For more information:

  2. Click Next.

  3. Continue with Configure Rule-based decryption policy exclusions.

What to do next