By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Help with AWS/Palo Alto firewalls and SSL Decryption

0

Hello. One of our customers has an AWS solution with Palo Alto firewalls. Sitting in front of those is a load balancer and in the trust zone a web server. We have been asked to enable inbound ssl decryption on the Palo Alto's following a security issue earlier this year. We have created a web server cert and private key pair, imported to the palo's and created decryption profile and rules but the firewalls will not decrypt due to 'private key not matching public key'. We are wondering if this is due to the cert on the client (essentially the load balancer) being different. Traditionally the client would have the same cert as the server but in this case the client has an amazon cert. How do we get around this, what is the best way to set up, create a cert on the load balancer and use that on the client and web server? thanks

  • CarlosGP-AWS
    a year ago

    Hi there, Can you confirm if this is the flow of the packets: Clients->IGW->ALB->FW->Web-Server if thats the case, the ALB would be doing the TLS termination and sending the public cert to the client. From there, the ALB would create a new HTTP or HTTPS connection towards the Web-server. If its HTTPS, the ALB just accepts any certificate as it doesn't check for CA. So now you're trying to terminate this TLS connection on the Palo Alto Firewall? or you're trying to transparently inspect the incoming packets without terminating the connection? If you can elaborate on the part between the ALB->FW->Web-Server so I can try and help point the issue.

Topics
Security, Identity, & ComplianceNetworking & Content DeliveryAWS Well-Architected Framework
Tags
Security, Identity, & ComplianceNetworking & Content DeliveryElastic Load BalancingAWS Certificate ManagerSecurity
Language
English
rePost-User-7047468
asked 2 years ago180 views
No Answers

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content