ā06-26-2024 03:04 PM
I have not been able to find any good documentation on how to generate/install a certificate issued by an Active Directory CA for use with SSL Decryption policy. I've read through the config guides for 7.2x. It seems like this would be an incredibly common scenario. Any help would be appreciated.
Thanks - David
ā06-26-2024 03:16 PM - edited ā06-26-2024 03:17 PM
@davparker try this guide https://integratingit.wordpress.com/2019/02/16/firepower-ssl-decryption/
When signing the CSR make sure the certificate template selected is the Subordinate Root Authority.
ā06-26-2024 03:16 PM - edited ā06-26-2024 03:20 PM
ā06-27-2024 07:41 AM
Thanks. My PKI person is asking about the compatibility settings on Subordinate Certificate Authority Template used to generate the certificate for the following fields:
Certificate Authority
Certificate Recipient
Our AD servers are at ver 2016. Any thoughts?
ā06-27-2024 08:14 AM
@davparker the standard Microsoft Sub CA template will suffice. They could duplicate the existing template (without modifications) if they wish.
ā06-27-2024 01:51 PM
Very nice! Decryption is now working. Now trying to figure out what not to decrypt prior to enabling it for more resources.
ā06-27-2024 01:58 PM
@davparker glad to hear it's working.
FYI, SSL decryption is expensive on resources, so I would be selective on what you decrypt, don't decrypt everything.
ā06-27-2024 02:17 PM - edited ā06-27-2024 02:20 PM
I think you need to config decrypt known key i.e. the server inside your network
so using it IP to filter which traffic need to decrypt
if you allow all traffic your traffic will start drop
MHM
ā06-27-2024 03:02 PM
All our Internet exposed servers are in external data centers. We basically have no inbound rules other than what is needed for VPN. I plan on excluding traffic from decryption for our common domains where most our business apps reside. Also excluding stuff like WebEx and Teams. Also for What categories of web traffic do people typically decrypt traffic for?
ā07-02-2024 11:16 AM
FYI,
I found this resource to be very helpful when trying to figure out what to decrypt vs DND. BRKSEC-3063 (ciscolive.com)
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide