<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><font face="monospace">Hey Antony,</font></p>
<p><font face="monospace">Thanks for the quick response.</font></p>
<blockquote type="cite" style="color: #007cff;">
<pre class="moz-quote-pre" wrap="">- What sort of firewall is this?
</pre>
</blockquote>
<p><font face="monospace">The firewall is a Cisco FTDv 6.6. </font><br>
</p>
<p>
</p>
<blockquote type="cite" style="color: #007cff;">
<pre class="moz-quote-pre" wrap=""> - What does "HTTPS inspect" actually mean?
- How does the firewall "inspect" HTTPS traffic, which by design is encrypted
between client and server (neither of which is the firewall)?
- What does "inspect" mean? What information is revealed from the inspection
of the encrypted communication?
</pre>
</blockquote>
<p><font face="monospace">It's doing something they call 'decrypt
and resign'. Similar to how ssl_bump works, so would putting the
firewall certificate on the Squid server's trusted certificates
source be enough?</font>
</p>
<blockquote type="cite" style="color: #007cff;">
<pre class="moz-quote-pre" wrap="">Why? Where would the proxy servers need to be instead, in order for this
inspection to work?
</pre>
</blockquote>
<p><font face="monospace">Good question, their documentation says
the following:</font></p>
<blockquote>
<p><font face="monospace">HTTP proxy limitation<br>
<br>
The system cannot decrypt traffic if an HTTP proxy is
positioned between a client and your managed device, and the
client and server establish a tunneled TLS/SSL connection
using the CONNECT HTTP method. The Handshake Errors
undecryptable action determines how the system handles this
traffic.</font></p>
</blockquote>
<blockquote type="cite" style="color: #007cff;">
<pre class="moz-quote-pre" wrap="">Alternatively, how does/would it work if the proxy were not there, and clients
communicated directly to the Internet through the firewall?
</pre>
</blockquote>
<p><font face="monospace">If the proxy wasn't there, it looks like
it works the same as ssl_bump.</font></p>
<blockquote type="cite" style="color: #007cff;">
<pre class="moz-quote-pre" wrap="">Have you asked the suppliers / authors / vendors of the firewall?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">Not yet but I will be doing so today.
</pre>
<blockquote type="cite" style="color: #007cff;">
<pre class="moz-quote-pre" wrap="">If it's the firewall telling you there's a problem, this doesn't entirely feel
like a Squid question.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">Okay, what if we removed the firewall and replaced it with another squid proxy server, where that is also doing ssl_bump. I assume this would work but are there negative implications of doing so?
Appreciate you taking the time.
Thanks,
Will
</pre>
<div class="moz-cite-prefix">On 04/01/2022 00:35, Antony Stone
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:202201040135.48476.Antony.Stone@squid.open.source.it">
<pre class="moz-quote-pre" wrap="">On Tuesday 04 January 2022 at 01:19:28, Will BMD wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Hey all,
I currently have the following network topology, it's emulating a real
world environment. The proxy is running ssl_bump.
LAN <-> Squid Proxy <-> Firewall <-> Internet
>From the Firewall's perspective all client connections are originating
as the proxy server.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Okay, that makes good sense.
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">We're wanting to use the https inspect feature of the firewall,
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Please give more details?
- What sort of firewall is this?
- What does "HTTPS inspect" actually mean?
- How does the firewall "inspect" HTTPS traffic, which by design is encrypted
between client and server (neither of which is the firewall)?
- What does "inspect" mean? What information is revealed from the inspection
of the encrypted communication?
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">but according to our firewall documentation it appears due to the location of
our proxy servers we would be unable to do so.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Why? Where would the proxy servers need to be instead, in order for this
inspection to work?
Alternatively, how does/would it work if the proxy were not there, and clients
communicated directly to the Internet through the firewall?
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">My question is, if the proxy is behaving as a MITM between itself and
the client, can't the Firewall do the same thing between itself and the
proxy?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
I agree. Have you asked the suppliers / authors / vendors of the firewall?
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">I suspect it is possible, but might potentially involve a lot of headaches
and a big hit on performance?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Who knows?
If it's the firewall telling you there's a problem, this doesn't entirely feel
like a Squid question.
Antony.
</pre>
</blockquote>
</body>
</html>