General Settings

 

With SSL inspection, the acts as a 'man-in-the-middle' between a client and a remote server, when the client and server are communicating using an SSL-encrypted session. Every time the client and server send data to each other, the decrypts the sender’s encrypted data, scans the plain data for threats, re-encrypts the data, and then sends the encrypted data to the receiver.

To perform SSL Inspection for clients using SSL (HTTPS, SSH, SMTP) through the , the must check that the server’s certificate with corresponding public key are valid and were issued by a Certificate Authority (CA) listed in the Zyxel Device's list of trusted CAs. According to the selected key mode RSA 1024, RSA 2048, ECDSA-RSA-1024 or ECDSA-RSA-2048, the will construct the corresponding self-signed certificate for the virtual server.

RSA is a public-key cryptosystem used for data encryption or signing messages. For data encryption, the encryption key is public and the decryption key is private. For signing messages, the signing key is private and the verification key is public. Elliptic Curve Cryptography (ECC) is a public-key cryptosystem based on elliptic curve theory, and more efficient than RSA. ECC allows smaller keys compared to RSA to provide equivalent security. For example, a 224-bit elliptic curve public key should provide comparable security to a 2048-bit RSA public key.

Select a mode that the client’s browser, FTP client, or mail client supports. The will use different keys (cryptosystems) for each client according to the client’s support list.

For example, if there are three clients behind a with the following key mode support:

If you set the key mode to ECDSA-RSA-1024, then the following will be used by each client:

If you set the key mode to ECDSA-RSA-2048, then the following will be used by each client:

Statistics

Enable this to have the Zyxel Device collect SSL inspection statistics.

Profile Management

 

Click Add to create a new profile.

Select an entry and click this to be able to modify it.

Select an entry and click this to delete it.

Select an entry and click References to open a screen that shows which settings use the entry.

Click this icon to apply the entry to a policy control rule.

Go to the Security Policy > Policy Control screen to check the result.

This is the entry’s index number in the list.

Name

This displays the name of the profile.

Description

This displays the description of the profile.

CA Certificate

This displays the CA certificate being used in this profile.

Reference

This displays the number of times an object reference is used in a profile.

Name

This is the name of the profile. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. These are valid, unique profile names:

These are invalid profile names:

Description

Enter additional information about this SSL Inspection entry. You can enter up to 60 characters (0-9a-zA-Z’()+:=?;!*#@$_%-”). The first character must be a letter.

CA Certificate

This contains the default certificate and the certificates created in Object > Certificate > My Certificates. Choose the certificate for this profile.

Email

Use this button to have the Zyxel Device send the selected certificate to a valid email address.

Click a certificate’s row to select it and click Email to have the Zyxel Device mail that certificate. The following screen displays.

Enter a email subject text with 1-60 characters. It may consist of letters, numbers, and the following special characters: ‘()+,./:=?;!*#@$%-

Enter up to 83 characters for the email address of the receiver

Enter the backup email body text using 1 to 251 single-byte characters, including 0-9a-zA-Z!”#$%&’()*+,-./:;<=>@[\]^_‘{|} and spaces are allowed.

? is not allowed.

Click this to send the email to the email address you configured.

Click this to close the screen.

SSL/TLS version

 

SSL / TLS connections using versions lower than this setting are blocked.

These are the log options for unsupported traffic that matches traffic bound to this policy:

Unsupported suit

 

SSL Inspection supports these cipher suites:

Select to pass or block unsupported traffic (such as other cipher suites, compressed traffic, client authentication requests, and so on) that matches traffic bound to this policy here.

These are the log options for unsupported traffic that matches traffic bound to this policy:

Untrusted cert chain

 

A certificate chain is a certification process that involves the following certificates between the SSL/TLS server and a client. A certificate chain will fail if one of the following certificates is not correct.

Select to pass, inspect, or block an untrusted certification chain.

These are the log options for unsupported traffic that matches traffic bound to this policy:

Apply

Click Apply to save your settings to the Zyxel Device, and return to the profile summary page.

Reset

Click Reset to return to the profile summary page without saving any changes.

General Settings

 

Click this to create a log for traffic that bypasses SSL Inspection.

Exclude List Address Settings

Use this part of the screen to create, edit, or delete items in the SSL Inspection exclusion list.

Click this to create a new entry.

Select an entry and click this to be able to modify it.

Select a row and click this to delete it.

SSL traffic to a server to be excluded from SSL Inspection is identified by its certificate. Identify the certificate in one of the following ways:

Apply

Click Apply to save your settings to the Zyxel Device.

Cancel

Click Cancel to return to the profile summary page without saving any changes.

Certificate Information

 

This displays the current certificate set version.

This field displays the date and time the current certificate set was released.

Certificate Update

You should have Internet access and have activated SSL Inspection on the Zyxel Device at NCC.

Click this button to download the latest certificate set (Windows, MAC OS X, and Android) from the Zyxel cloud server and update it on the Zyxel Device.

Select this to automatically have the Zyxel Device update the certificate set when a new one becomes available on the Zyxel cloud server.

Apply

Click Apply to save your settings to the Zyxel Device.

Cancel

Click Cancel to return to the profile summary page without saving any changes.