General Settings

 

With SSL inspection, the acts as a 'man-in-the-middle' between a client and a remote server, when the client and server are communicating using an SSL-encrypted session. Every time the client and server send data to each other, the decrypts the sender’s encrypted data, scans the plain data for threats, re-encrypts the data, and then sends the encrypted data to the receiver.

To perform SSL Inspection for clients using SSL (HTTPS, SSH, SMTP) through the , the must check that the server’s certificate with corresponding public key are valid and were issued by a Certificate Authority (CA) listed in the Zyxel Device's list of trusted CAs. According to the selected key mode RSA 1024, RSA 2048, ECDSA-RSA-1024 or ECDSA-RSA-2048, the will construct the corresponding self-signed certificate for the virtual server.

RSA is a public-key cryptosystem used for data encryption or signing messages. For data encryption, the encryption key is public and the decryption key is private. For signing messages, the signing key is private and the verification key is public. Elliptic Curve Cryptography (ECC) is a public-key cryptosystem based on elliptic curve theory, and more efficient than RSA. ECC allows smaller keys compared to RSA to provide equivalent security. For example, a 224-bit elliptic curve public key should provide comparable security to a 2048-bit RSA public key.

Select a mode that the client’s browser, FTP client, or mail client supports. The will use different keys (cryptosystems) for each client according to the client’s support list.

For example, if there are three clients behind a with the following key mode support:

If you set the key mode to ECDSA-RSA-1024, then the following will be used by each client:

If you set the key mode to ECDSA-RSA-2048, then the following will be used by each client:

Profile Management

 

Click Add to create a new profile.

Select an entry and click this to be able to modify it.

Select an entry and click this to delete it.

Select an entry and click References to open a screen that shows which settings use the entry.Click Refresh to update information on this screen.

This is the entry’s index number in the list.

Name

This displays the name of the profile.

Description

This displays the description of the profile.

CA Certificate

This displays the CA certificate being used in this profile.

Reference

This displays the number of times an object reference is used in a profile.

Action

Click this icon to apply the entry to a security policy.

Go to the Configuration > Security Policy > Policy Control screen to check the result.

Show Filter/Hide Filter

Click Show Filter to display IPv4 and IPv6 (if enabled) security policy search filters.

IPv4 / IPv6 Configuration

Use IPv4 / IPv6 search filters to find specific IPv4 and IPv6 (if enabled) security policies based on direction, application, user, source, destination and/or schedule.

Select a zone to view all security policies from a particular zone and/or to a particular zone. any means all zones.

Type an IPv4 or IPv6 IP address to view all security policies based on the IPv4 / IPv6 source address object used.

Type an IPv4 or IPv6 IP address to view all security policies based on the IPv4 / IPv6 destination address object used.

View all security policies based the service object used.

View all security policies based on user or user group object used.

View all security policies based on the schedule object used.

Priority

This is the position of your Security Policy in the global policy list (including all through-Zyxel Device and to-Zyxel Device policies). The ordering of your policies is important as policies are applied in sequence. Default displays for the default Security Policy behavior that the Zyxel Device performs on traffic that does not match any other Security Policy.

Status

This icon is lit when the entry is active and dimmed when the entry is inactive.

Name

This is the name of the Security policy.

From / To

This is the direction of travel of packets. Select from which zone the packets come and to which zone they go.

Security Policies are grouped based on the direction of travel of packets to which they apply. For example, from LAN to LAN means packets traveling from a computer or subnet on the LAN to either another computer or subnet on the LAN.

From any displays all the Security Policies for traffic going to the selected To Zone.

To any displays all the Security Policies for traffic coming from the selected From Zone.

From any to any displays all of the Security Policies.

To ZyWALL policies are for traffic that is destined for the Zyxel Device and control which computers can manage the Zyxel Device.

IPv4 / IPv6 Source

This displays the IPv4 / IPv6 source address object, including geographic address and FQDN (group) objects, to which this Security Policy applies.

IPv4 / IPv6 Destination

This displays the IPv4 / IPv6 destination address object, including geographic address and FQDN (group) objects, to which this Security Policy applies.

Service

This displays the service object to which this Security Policy applies.

User

This is the user name or user group name to which this Security Policy applies.

Schedule

This field tells you the schedule object that the policy uses. none means the policy is active at all times if enabled.

Action

This field displays whether the Security Policy silently discards packets without notification (deny), permits the passage of packets (allow) or drops packets with notification (reject)

Log

Select whether to have the Zyxel Device generate a log (log), log and alert (log alert) or not (no) when the policy is matched to the criteria listed above.

Profile

This field shows you which Security Service profiles (application patrol, content filter, IDP, anti-malware, email security) apply to this Security policy. Click an applied Security Service profile icon to edit the profile directly.

OK

Click OK to save your changes back to the Zyxel Device.

Cancel

Click Cancel to exit this screen without saving.

Name

This is the name of the profile. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. These are valid, unique profile names:

These are invalid profile names:

Description

Enter additional information about this SSL Inspection entry. You can enter up to 60 characters ("0-9", "a-z", "A-Z", "-" and "_").

CA Certificate

This contains the default certificate and the certificates created in Object > Certificate > My Certificates. Choose the certificate for this profile.

SSL/TLS version supported minimum

SSL / TLS connections using versions lower than this setting are blocked.

These are the log options for unsupported traffic that matches traffic bound to this policy:

Action for Connection with unsupported suit

SSL Inspection supports these cipher suites:

Select to pass or block unsupported traffic (such as other cipher suites, compressed traffic, client authentication requests, and so on) that matches traffic bound to this policy here.

These are the log options for unsupported traffic that matches traffic bound to this policy:

Action for connection with untrusted cert chain

A certificate chain is a certification process that involves the following certificates between the SSL/TLS server and a client. A certificate chain will fail if one of the following certificates is not correct.

Select to pass, inspect, or block an untrusted certification chain.

These are the log options for unsupported traffic that matches traffic bound to this policy:

OK

Click OK to save your settings to the Zyxel Device, and return to the profile summary page.

Cancel

Click Cancel to return to the profile summary page without saving any changes.

General Settings

 

Click this to create a log for traffic that bypasses SSL Inspection.

Exclude List Settings

Use this part of the screen to create, edit, or delete items in the SSL Inspection exclusion list.

Click this to create a new entry.

Select an entry and click this to be able to modify it.

Select an entry and click this to delete it.

This is the entry’s index number in the list.

SSL traffic to a server to be excluded from SSL Inspection is identified by its certificate. Identify the certificate in one of the following ways:

Alternatively, to automatically add an entry for existing SSL traffic to a destination server, go to Monitor > Security Statistics > SSL Inspection > Certificate Cache List, select an item and then click Add to Exclude List. The item will then appear here.

Apply

Click Apply to save your settings to the Zyxel Device.

Reset

Click Reset to return to the profile summary page without saving any changes.

Certificate Information

 

This displays the current certificate set version.

This field displays the date and time the current certificate set was released.

Certificate Update

You should have Internet access and have activated SSL Inspection on the Zyxel Device at myZyxel.

Click this button to download the latest certificate set (Windows, MAC OS X, and Android) from the myZyxel and update it on the Zyxel Device.

Select this to automatically have the Zyxel Device update the certificate set when a new one becomes available on myZyxel.

Apply

Click Apply to save your settings to the Zyxel Device.

Reset

Click Reset to return to the profile summary page without saving any changes.