Note	TLS is the successor of SSL. This document uses the term TLS to refer to both SSL and TLS.

Today more and more apps and data reside in the cloud. As a result, majority of internet traffic is encrypted. This may lead to malware remaining hidden and lack of control over security. The TLS proxy feature allows you to configure edge devices as transparent TLS proxy. This feature has been integrated with Cisco Unified Threat Defense (UTD).

TLS proxy devices act as man-in-the-middle (MitM) to decrypt encrypted TLS traffic traveling across WAN, and send it to (UTD) for inspection. TLS Proxy thus allows devices to identify risks that are hidden by end-to-end encryption over TLS channels. The data is re-encrypted post inspection before being sent to its final destination.

Traffic Flow with TLS Proxy

A typical TLS handshake involves authentication using certificates signed by trusted, third-party Certificate Authorities (CAs). The clients and servers must trust these CAs in order to establish trust. TLS Proxy acts as MitM and runs a CA to issue proxy certificates for the connection dynamically.

This is how traffic flows when TLS proxy is enabled:

1. A TCP connection is established between the client and the proxy, and the proxy and the server.

2. If a decryption policy is enabled for the flow, a client Hello packet is sent to UTD to determine the decryption action.

3. Based on the UTD verdict, one of the following actions takes place:

   • drop: If the verdict is drop, the hello packet from the client is dropped and the connection is reset.

   • do-not-decrypt: If the verdict is do-not-decrypt, the hello packet bypasses TLS proxy.

   • decrypt: If the verdict is decrypt, the packet is forwarded to the client and goes through the following:

     1. TCP optimization for optimization of traffic

     2. Decryption of encrypted traffic through TLS proxy

     3. Threat inspection through UTD

     4. Re-encryption of decrypted traffic through TLS proxy

Note	If there is a delay in determining the decrypt status of the flow, the UTD configuration for fail-decrypt is exercised.

The following image shows the TLS handshake process.

The following devices support the SSL/TLS Proxy feature.

• Flow symmetry is required for branches with dual routers.

• If you have multiple internet links, the flows must be pinned to only one of them. This ensures that the sites that require an SSL client have the same source IP address.

• TLS proxy devices and the clients must have their times in sync. See Configure NTP to learn how to synchronize all devices in the Cisco Catalyst SD-WAN solution.

Note	Cisco recommends enabling TLS decryption only for encrypted traffic (for example HTTPS, SFTP) by creating a specific rule in the NG firewall policy. Unencrypted traffic should not be subjected to TLS decryption.

• Only RSA and its variant cipher suites are supported.

• Certificate Revocation List (CRL) check is not supported for server certificate validation. However, you can enable OCSP from Advanced Settings in SSL Decryption policy.

• When a Cisco public key (PKI) certificate is installed on a device, and you want to make changes to the certificate, detach the security template from the device template and push the device template to the device. This will remove the existing PKI certificate and configuration. After you have made changes to the PKI certificate, re-attach the security template and then push the device template to the device. This process updates the device for any the changes to the Cisco PKI certificate.

• OCSP stapling is not supported and must be explicitly disabled on the browser for the TLS session to be established.

• For branch-to-branch and branch-to-data center traffic scenarios that support service nodes, the SSL decryption security policy must be applied in a way that prevents the SSL flow from being inspected on both the devices.

• IPv6 traffic is not supported.

• TLS session resumption, renegotiation and client certificate authentication are not supported.

• If TLS proxy crashes, it takes up to two minutes for it to be ready to serve as proxy for TLS flows again. During this time, depending upon your security settings, the flows are either bypassed or dropped.

Cisco SD-WAN Manager offers the following options to set up a CA.

The SSL decryption policy provides the following ways to divert traffic for decryption:

• Network-based rules: Diverts traffic on the basis of the source or destination IP address, port, VPNs, and application.

• URL-based rules: Decide whether to decrypt based on the URL category or reputation of the URL.The decision is made based on the Client Hello packet.

For URL-based rules, note the following:

• A NAT direct internet access route is necessary to implement TLS/SSL decryption.

• You can set blocked list URLs to always be decrypted

• You can set allowed list URLs to never be decrypted.

• If a URL lookup to the cloud takes too long, the user can set one of the following:

  • Decrypt the traffic

  • Skip decryption for this traffic temporarily

To configure SSL decryption through a security policy, use the Cisco SD-WAN Manager security configuration wizard:

1. From the Cisco SD-WAN Manager menu, choose Configuration > Security.

2. Click Add Security Policy. The Add Security Policy wizard opens, and various use-case scenarios are displayed.

3. In Add Security Policy, choose a scenario that supports the TLS/SSL Decryption feature (Compliance, Guest Access, Direct Cloud Access, Direct Internet Access, or Custom).

4. Click Proceed to add an SSL decryption policy in the wizard.

5. • If this is the first time you're creating a TLS/SSL decryption policy, then you must create and apply a policy to the device before creating security policies that can use a security policy (such as Intrusion Prevention, URL Filtering, or Advanced Malware Protection). In the Add Security Policy wizard, click Next until the TLS/SSL Decryption screen is displayed.

   • If you want to use TLS/SSL decryption along with other security features such as Intrusion Prevention, URL Filtering, or Advanced Malware Protection, add those features as described in this book. Once you've configured those features, click Next until the TLS/SSL Decryption screen is displayed.

6. Click the Add TLS/SSL Decryption Policy drop-down menu and choose Create New to create a new SSL decryption policy. The TLS/SSL Decryption Policy Configuration wizard appears.

7. Ensure that SSL Decryption is Enabled.

8. In the Policy Name field, enter the name of the policy.

9. Click Add Rule to create a rule.

   The New Decryption Rule window is displayed.

   Note	For branch-to-branch and branch-to-data center traffic scenarios that support service nodes, the SSL decryption security policy must be applied in a way that prevents the SSL flow from being inspected on both the devices.

10. Choose the order for the rule that you want to create.

11. In the Name field, enter the name of the rule.

12. You can choose to decrypt traffic based on source / destination which is similar to the firewall rules or applications which is similar to URL-Filtering rules.

    • If you choose Source / Destination, enter any of the following conditions:

      • Source VPNs

      • Source Networks

      • Source Ports

      • Destination VPNs

      • Destination Networks

      • Destination Port

      • Application/Application Family List

    • If you choose URLs, enter the following:

      • VPNs

      • TLS/SSL profile.

        1. Enter a name for the profile.

        2. Choose Decrypt, No Decrypt or Pass Through. Alternatively, you can choose multiple categories and set the action for all of them using the actions drop-down menu.

13. (Optional) To configure advanced settings such as server certificate checks, minimum TLS version, and so on, expand Advanced Settings

    Note	By default, Cisco SD-WAN Manager configures the default values for each advanced setting. If you change any of these settings, it may affect the behaviour of the decryption security policies.

    • Under the Server Certificate Checks section, you can configure the following:

      Field Name	Description	Options
      Expired Certificate	Defines what the policy should do if the server certificate is expired	Drop the traffic Decrypt the traffic
      Untrusted Certificate	Defines what the policy should do if the server certificate is not trusted	Drop the traffic Decrypt the traffic
      Certificate Revocation Status	Defines whether Online Certificate Status Protocol (OCSP) should be used to check the revocation status of the server certificate	Enabled or Disabled
      Unknown Revocation Status	Defines what the policy should do, if the OCSP revocation status is unknown	Drop the traffic Decrypt the traffic

    • Under the Proxy Certificate Attributes section, you can configure the following:

      Field Name	Description	Options
      RSA Keypair Modules	Defines the Proxy Certificate RSA Key modulus	1024 bit RSA 2048 bit RSA 4096 bit RSA
      Certificate Lifetime (in Days)	Sets the lifetime of the proxy certificate in days.
      Minimum TLS Version Revocation Status	Sets the minimum version of TLS that the proxy should support.	TLS 1.0 TLS 1.1 TLS 1.2

    • Under the Unsupported Mode Checks section, you can configure the following:

      Field Name	Description	Options
      Unsupported Protocol Versions	Defines what the policy should do if an unsupported protocol version is detected.	Drop the traffic No Decrypt: The proxy does not decrypt this traffic.
      Unsupported Cipher Suites	Defines what the policy should do if unsupported cipher suites are detected.	Drop the traffic No Decrypt: The proxy does not decrypt this traffic.
      Failure Mode	Defines what the policy should do in the case of a failure.	Close: Sets the mode as fail-close Open: Sets the mode as fail-open.
      Certificate Bundle	Defines whether the policy should use the default CA certificate bundle or not	You can choose or not choose this option. If you do not choose this option, the Custom Certificate Bundle option appears and you must upload a certificate by clicking Select a file. Note   If you choose to use or update a custom certificate bundle for SSL decryption, ensure that the same certificate bundle is used across all devices in the network that have SSL decryption enabled.

14. Click Save TLS/SSL Decryption Policy.

15. Click Next.

16. Enter Security Policy Name and Security Policy Description in the respective fields.

17. Click Save Policy to configure the Security policy.

18. To edit the existing SSL decryption policy, click Custom Options in the Security wizard.

1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

2. If you are creating a new device template:

   1. Click Device Templates, and click Create Template.

      Note	In Cisco vManage Release 20.7.1 and earlier releases, Device Templates is called Device.

   2. From the Create Template drop-down menu, choose From Feature Template.

   3. From the Device Model drop-down menu, choose one of the devices.

   4. In the Template Name field, enter a name for the device template. This field is mandatory and can contain only uppercase and lowercase letters, the digits 0 through 9, hyphens (–), and underscores (_). It cannot contain spaces or any other characters.

   5. In the Description field, enter a description for the device template. This field is mandatory, and it can contain any characters and spaces.

   6. Continue with Step 4.

3. If you are editing an existing device template:

   1. Click Device, and click ... and click Edit.

   2. Click Additional Templates. The screen scrolls to the Additional Templates section.

   3. From the Policy drop-down menu, choose the name of a policy you have configured.

4. Click Additional Templates located directly beneath the Description field. The screen scrolls to the Additional Templates section.

5. From the Security Policy drop-down menu, choose the name of the security policy you configured in the above procedure.

6. Click Create (for a new template) or Update (for an existing template).

1. From the Cisco SD-WAN Manager menu, choose Monitor > Devices.

   Cisco vManage Release 20.6.x and earlier: From the Cisco SD-WAN Manager menu, choose Monitor > Network.

2. Choose a device from the list of devices that displays.

3. Click SSL Proxy in the left pane.

4. The right pane has the following options to choose from.

   • Traffic View: From the drop-down menu, choose one of the following–All Policy Actions, Encrypted, Un-encrypted, Decrypted.

   • Filter: You have the option to filter the traffic statistics by VPN, TLOC, Remote TLOC, and Remote System IP.

   • SSL Proxy View Format: You can choose to view the SSL proxy information in form of a line graph, bar chart, or a pie chart.

   • Time Range: Choose to view the information for a specified time range (1h, 3h, 6h, and so on) or click Custom to define a time range.

5. Based on your choice, the information displays. Additional information is displayed in tabular format.

1. From the Cisco SD-WAN Manager menu, choose Monitor > Devices.

   Cisco vManage Release 20.6.x and earlier: From the Cisco SD-WAN Manager menu, choose Monitor > Network.

2. Choose a device from the list of devices that displays.

3. Under the Security Monitoring pane, click TLS/SSL Decryption in the left pane.

4. The the right pane has the following options to choose from.

   • Network Policy: You can view the traffic information for an applied network policy.

   • URL Policy: You can view the traffic information of a URL policy.

   • Time Range: Choose to view the information for a specified time range (1h, 3h, 6h, and so on) or click Custom to define a time range.

5. Based on your choice, the information displays.

   Additionally, from the Security Monitoring pane, you can also view information for other Security features such as Firewall, Intrusion Prevention, URL Filtering, and so on.

Follow these steps to revoke, renew, or revoke and renew a certificate for a device configured as TLS proxy using Enterprise CA.

If you have configured Cisco SD-WAN Manager as CA or Cisco SD-WAN Manager as Intermediate CA, follow the steps below to revoke or renew a certificate.

1. From the Cisco SD-WAN Manager menu, choose Configuration > Certificates.

2. Click TLS Proxy.

   You will see a list of devices configured as CA.

3. Choose the device.

4. Click Revoke Certificate or Renew Certificate to revoke or renew the certificate respectively.