防火墙配置SSL解密怎么操作

如下图所示，Device作为安全网关部署在内网边界。由于设备无法对HTTPS流量进行深度安全检测，导致无法阻断部分网站的访问。现需要配置SSL解密功能，对HTTPS流量进行SSL解密，再进行DPI业务检测，保护企业内网用户安全。

图-1 SSL解密功能配置组网图

‌

配置步骤

1. 配置接口IP地址

# 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。

<Device> system-view

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] ip address 192.168.1.1 255.255.255.0

[Device-GigabitEthernet1/0/1] quit

请参考以上步骤配置其他接口的IP地址，具体配置步骤略。

2. 配置静态路由

本举例仅以静态路由方式配置路由信息。实际组网中，请根据具体情况选择相应的路由配置方式。

# 请根据组网图中规划的信息，配置静态路由，本举例假设到达外网Web Server的下一跳IP地址为2.2.2.2，实际使用中请以具体组网情况为准，具体配置步骤如下。

[Device] ip route-static 5.5.5.0 24 2.2.2.2

3. 配置接口加入安全域

# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。

[Device] security-zone name trust

[Device-security-zone-Trust] import interface gigabitethernet 1/0/1

[Device-security-zone-Trust] quit

[Device] security-zone name untrust

[Device-security-zone-Untrust] import interface gigabitethernet 1/0/2

[Device-security-zone-Untrust] quit

4. 配置对象组

# 创建名为obj1的IP地址对象组，并配置其子网地址为192.168.1.0/24。

[Device] object-group ip address obj1

[Device-obj-grp-ip-obj1] network subnet 192.168.1.0 24

[Device-obj-grp-ip-obj1] quit

5. 导入SSL解密证书

# 导入名为trust.pem的可信SSL解密证书和名为untrust.pem的不可信SSL解密证书，分别用于签发标识为可信和不可信的代理服务器证书。

[Device] app-proxy ssl-decrypt-certificate import trust pem filename trust.pem

[Device] app-proxy ssl-decrypt-certificate import untrust pem filename untrust.pem

6. 在内网用户浏览器上安装并信任名为trust.pem的可信SSL解密证书（具体配置步骤略）。

7. 配置代理策略及规则

# 创建名为https的代理策略规则，对所有通过HTTPS协议访问Web服务器的连接进行SSL解密。

[Device] app-proxy-policy

[Device-app-proxy-policy] rule 1 name https

[Device-app-proxy-policy-rule-1-https] source-zone trust

[Device-app-proxy-policy-rule-1-https] destination-zone untrust

[Device-app-proxy-policy-rule-1-https] source-ip object-group obj1

[Device-app-proxy-policy-rule-1-https] service object-group https

[Device-app-proxy-policy-rule-1-https] action ssl-decrypt

[Device-app-proxy-policy-rule-1-https] quit

8. 配置URL过滤功能

# 创建名称为https的自定义URL过滤分类，并在分类中添加主机名www.baidu.com。

[Device] url-filter category https severity 1001

[Device-url-filter-category-https] rule host text www.baidu.com

[Device-url-filter-category-https] quit

# 创建名为p1的URL过滤策略，配置自定义分类https的动作为重置并生成日志。

[Device] url-filter policy p1

[Device-url-filter-policy-p1] category https action reset logging

[Device-url-filter-policy-p1] quit

9. 配置DPI应用profile并激活URL过滤策略和规则配置

# 创建名为sec的DPI应用profile，并在DPI应用profile sec中应用URL过滤策略p1。

[Device] app-profile sec

[Device-app-profile-sec] url-filter apply policy p1

[Device-app-profile-sec] quit

# 激活URL过滤策略和规则配置。

[Device] inspect activate

10. 配置安全策略

# 配置名称为trust-untrust的安全策略规则，使内网用户可以访问外网，并对交互报文进行URL过滤业务检测。具体配置步骤如下。

[Device] security-policy ip

[Device-security-policy-ip] rule name trust-untrust

[Device-security-policy-ip-10-trust-untrust] source-zone trust

[Device-security-policy-ip-10-trust-untrust] source-ip-subnet 192.168.1.0 24

[Device-security-policy-ip-10-trust-untrust] destination-zone untrust

[Device-security-policy-ip-10-trust-untrust] action pass

[Device-security-policy-ip-10-trust-untrust] profile sec

[Device-security-policy-ip-10-trust-untrust] quit

# 按照同样的步骤，配置名称为untrust-trust的安全策略规则，由于使用SSL代理功能时，设备同时作为代理客户端和代理服务器，需要放行外网到内网的流量。具体配置步骤如下。

[Device] security-policy ip

[Device-security-policy-ip] rule name untrust-trust

[Device-security-policy-ip-11-untrust-trust] source-zone untrust

[Device-security-policy-ip-11-untrust-trust] destination-zone trust

[Device-security-policy-ip-11-untrust-trust] destination-ip-subnet 192.168.1.0 24

[Device-security-policy-ip-11-untrust-trust] action pass

[Device-security-policy-ip-11-untrust-trust] profile sec

[Device-security-policy-ip-11-untrust-trust] quit

# 按照同样的步骤，配置名称为proxyserverlocalin和proxyserverlocalout的安全策略规则，保证设备可作为代理服务器，对客户端向服务器发起的访问流量进行代理。具体配置步骤如下。

[Device-security-policy-ip] rule name proxyserverlocalin

[Device-security-policy-ip-12-proxyserverlocalin] source-zone trust

[Device-security-policy-ip-12-proxyserverlocalin] source-ip-subnet 192.168.1.0 24

[Device-security-policy-ip-12-proxyserverlocalin] destination-zone local

[Device-security-policy-ip-12-proxyserverlocalin] action pass

[Device-security-policy-ip-12-proxyserverlocalin] quit

[Device-security-policy-ip] rule name proxyserverlocalout

[Device-security-policy-ip-13-proxyserverlocalout] source-zone local

[Device-security-policy-ip-13-proxyserverlocalout] destination-zone trust

[Device-security-policy-ip-13-proxyserverlocalout] destination-ip-subnet 192.168.1.0 24

[Device-security-policy-ip-13-proxyserverlocalout] action pass

[Device-security-policy-ip-13-proxyserverlocalout] quit

# 按照同样的步骤，配置名称为proxyclientlocalin和proxyclientlocalout的安全策略规则，保证设备可作为代理客户端，对服务器发往客户端的流量进行代理。具体配置步骤如下。

[Device-security-policy-ip] rule name proxyclientlocalin

[Device-security-policy-ip-14-proxyclientlocalin] source-zone untrust

[Device-security-policy-ip-14-proxyclientlocalin] destination-zone local

[Device-security-policy-ip-14-proxyclientlocalin] destination-ip-subnet 192.168.1.0 24

[Device-security-policy-ip-14-proxyclientlocalin] action pass

[Device-security-policy-ip-14-proxyclientlocalin] quit

[Device-security-policy-ip] rule name proxyclientlocalout

[Device-security-policy-ip-15-proxyclientlocalout] source-zone local

[Device-security-policy-ip-15-proxyclientlocalout] source-ip-subnet 192.168.1.0 24

[Device-security-policy-ip-15-proxyclientlocalout] destination-zone untrust

[Device-security-policy-ip-15-proxyclientlocalout] action pass

[Device-security-policy-ip-15-proxyclientlocalout] quit

# 激活安全策略配置。

[Device-security-policy-ip] accelerate enhanced enable

[Device-security-policy-ip] quit