GigaVUE H Series nodes support Secure Sockets Layer (SSL) decryption. SSL is a cryptographic protocol that adds security to TCP/IP communications such as Web browsing and email. The protocol allows the transmission of secure data between a server and client who both have the keys to decode the transmission and the certificates to verify trust between them. Out-of-band SSL decryption delivers decrypted traffic to out-of-band tools that can then detect threats entering the network.
SSL decryption is a pillar of the GigaSECURE Security Delivery Platform. For an overview of GigaSECURE, refer to the “GigaSECURE Security Delivery Platform” section in the GigaVUE-FM User’s Guide.
Configure Out-of-Band SSL Decryption Examples
The following sections provide examples of out-of-band SSL decryption. Refer to the following:
• Example 1: Out-of-Band SSL Decryption with a Regular Map
• Example 2: Out-of-Band SSL Decryption with De-Duplication
• Other Usage Examples
For details on the CLI commands used in the following sections, refer to apps ssl, gsparams, and gsop in the reference section.
Example 1: Out-of-Band SSL Decryption with a Regular Map
In Example 1, a regular map is configured to use with out-of-band SSL decryption.
Step
Description
Command
- Upload a key and create a service. Refer to Working with Keys and Services on page 732.
(config) # apps ssl key alias key1 download type private-key url https://keyserver.domain.com/path/keyfile.pem
(config) # apps ssl service alias service1 server-ip 192.168.1.1 server-port 443
- Configure a GigaSMART group.
(config) # gsgroup alias gsgrp1 port-list 1/1/e1
- Specify the GigaSMART group alias.
(config) # gsparams gsgroup gsgrp1
- Specify a failover action.
(config gsparams gsgroup gsgrp1) # ssl-decrypt decrypt-fail-action drop
- Configure session timeouts, in seconds.
(config gsparams gsgroup gsgrp1) # ssl-decrypt pending-session-timeout 60
(config gsparams gsgroup gsgrp1) # ssl-decrypt session-timeout 300
(config gsparams gsgroup gsgrp1) # ssl-decrypt tcp-syn-timeout 20
- Configure cache timeouts, in seconds.
(config gsparams gsgroup gsgrp1) # ssl-decrypt key-cache-timeout 9000
(config gsparams gsgroup gsgrp1) # ssl-decrypt ticket-cache-timeout 9000
- Configure a key/service mapping that maps how a key is assigned to an IP address of a server.
(config gsparams gsgroup gsgrp1) # ssl-decrypt key-map add service service1 key key1
- Enable out-of-band SSL decryption.
(config gsparams gsgroup gsgrp1) # ssl-decrypt enable
- Exit the GigaSMART group configuration mode.
(config gsparams gsgroup gsgrp1) # exit
(config) #
- Configure a GigaSMART operation for out-of-band SSL decryption.
(config) # gsop alias gdssl1 ssl-decrypt in-port any out-port auto port-list gsgrp1
In the previous step, gdssl1 is the alias for a GigaSMART operation, in-port specifies the destination port on which to listen, out-port specifies the destination port on which to send decrypted traffic, and port-list is set to the GigaSMART group alias previously configured. The in-port and out-port arguments can also be a port number between 1 and 65535.
Next, configure a traffic map, as follows:
Step
Description
Command
- Specify a map alias (m1) and specify the map type and subtype.
(config) # map alias m1
(config map alias m1) # type regular byRule
- Specify the GigaSMART operation alias (gdssl1) as part of the map. This applies the associated GigaSMART functionality to packets matching a rule in the map.
(config map alias m1) # use gsop gdssl1
- Specify a map rule.
(config map alias m1) # rule add pass ipver 4
- Specify the destination for packets matching this map.
(config map alias m1) # to 1/1/g2
- Specify the source port(s) for this map.
(config map alias m1) # from 1/1/g1
- Exit the map prefix mode.
(config map alias m1) # exit
(config) #
- Display the configuration.
(config) # show gsop
(config) # show map
(config) # show gsparams
Example 2: Out-of-Band SSL Decryption with De-Duplication
In Example 2, the configuration steps are the same except when you configure a GigaSMART operation you send the decrypted traffic to de-duplication for additional filtering, as follows:
(config) # gsop alias gdssl1 ssl-decrypt in-port any out-port auto dedup set port-list gsgrp1
Other Usage Examples
Two typical usage examples are as follows:
• Use map rules to filter on the IP address of the server and send everything to GigaSMART. Configure a GigaSMART operation to listen on the in-port used by the server. The GigaSMART will drop other traffic.
• Use map rules to filter on the IP address of the server and in-port and send specific port traffic to the GigaSMART. Configure a GigaSMART operation to listen on in-port any.
