Setting Up Network Traffic Decryption and Inspection

Set up certificate authentication and Vault secrets to decrypt and inspect network traffic.

Vault secrets are used to decrypt and inspect SSL/TLS traffic.

SSL inbound inspection decrypts and inspects inbound SSL/TLS traffic from a client to a targeted network server. For more information on SSL inbound inspection, see SSL Inbound Inspection.

SSL forward proxy decrypts and inspect SSL/TLS traffic from internal users to the web. Only one SSL forward proxy secret is allowed for each firewall policy. For more information on SSL forward proxy, see SSL Forward Proxy,

After you create a firewall policy, you'll create a mapped secret to map the Vault secret to an inbound or outbound SSL key. Then you'll create a decryption profile to control how SSL forward proxy and SSL inbound inspection perform session mode checks, server checks, and failure checks.

For more information about how the certificate is used with a firewall policy, see Creating and Managing Firewall Policies.

Task 1: Allow the Network Firewall service to access Vault secrets

Create an IAM policy to allow the firewall policy to access and use Vault secrets.

To allow all firewall policies access to Vault service secrets:

Allow any-user to read secret-family in compartment <compartment_ID> where ALL {request.principal.type='networkfirewallpolicy'}

To allow one firewall policy access to Vault service secrets:

Allow any-user to read secret-family in compartment <compartment_ID> where ALL {request.principal.type='networkfirewallpolicy', request.principal.id='<Network Firewall Policy OCID>'}

Warning

If this permission is revoked later, the firewall will stop decrypting traffic because the service won't be able to access the mapped secret.

These policies replace the deprecated policy to access Vault secrets:

allow service ngfw-sp-prod to read secret-family in compartment <compartment_name>

Task 2: Create a vault and master key to store the certificate

Task 3: Store the certificate

You can use a self-signed or ca-signed certificate with OCI Network Firewall Service.

Oracle provides a script that you can use to generate a self-signed certificate.

Important

The Network Firewall service validates the provided certificate and stores it in the trustroot. To validate the certificate, provide the entire SSL certificate chain, including the intermediate certificates root certificate and private key. Upload certificates in .pem format which are wrapped in the following .json template.
If the leaf certificate specified in the "certKeyPair" is a forward-trust certificate, then it should have Certificate Authority Signing capability. Set the CA flag to "true".
In this example, if "LEAF_CERT_01_PEM_CONTENT" is a forward-trust certificate, its CA flag must be set to "true".
```
{
  "caCertOrderedList" : [
    "ROOT_CERT01_PEM_CONTENT",
    "INTERMEDIATE_CERT01_PEM_CONTENT",
    "INTERMEDIATE_CERT02_PEM_CONTENT",
  ],
  "certKeyPair": {
    "cert" : "LEAF_CERT_01_PEM_CONTENT",
    "key":   "PRIVATE_KEY_01_PEM_CONTENT"
  }
}
```

To use a self-signed OpenSSL certificate, you can use an Oracle provided script to create one:

Download and install OpenSSL.
Download and install Perl.
Download the script from the Oracle GitHub repository.
Run the script using the following command. Replace <test.test.com> with the DNS name of the webserver you need to protect:
```
./create-certificate inbound <test.test.com>
```
or
```
./create-certificate forward <test.test.com>
```

Task 4: Create secrets in the vault

Oracle Cloud Infrastructure Documentation

Setting Up Network Traffic Decryption and Inspection