[AusNOG] SSL packet inspection security

[Andres Miedzowicz]

Hi Jennifer,

Thanks for that. However, my question is more around the options of allowing access to millions of IPs (Office alone has /13s, /14s, /15s and /16s) or narrowing up the list of destination addresses and tightening up security at the expense of the potential caveats that the MITM approach the firewalls take to decrypt and inspect outgoing, secure traffic.

Regards,

Andres

Sent from my iPhone

On 16 Aug 2021, at 20:16, Jennifer Sims <jenn at jenn.id.au> wrote:


You should be able to cover 365 via the publicly available IP ranges
https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide

For amazon S3
https://aws.amazon.com/premiumsupport/knowledge-center/s3-find-ip-address-ranges/

That should give you a good starting point.

On Mon, Aug 16, 2021 at 7:36 PM Andres Miedzowicz <Andres.Miedzowicz at gsn.com.au<mailto:Andres.Miedzowicz at gsn.com.au>> wrote:
Hello,

I need to create a firewall rule for outgoing traffic from my network to the internet for services hosted in public clouds where the destination URL has multiple dynamic IPs (ie: an AWS S3 bucket, Outlook 365 in Azure, etc) which makes a rule based on a destination FQDN troubling because each DNS query will provide a different IP every time. My possible solutions are:


  1.  Use a firewall rule using a Web URL filter, or application/content filtering (depending on the vendor) where I need to perform deep packet inspection to get the full destination URL or detect the application (ie: email delivery to O365). When this method is used with most of the vendors, the process involves a MITM approach where the SSL Certificate presented to the client is one generated by the firewall with the root CA certificate issued by the firewall as well.



  1.  Set the destination IP of the rule the full list of possible ranges for the public cloud which could mean millions of IPs.

Any thoughts on security concerns with each of the approaches? Is it worth the potential decrease in security by using a non-trusted Root CA internally (even though we can install the certificate in the application/browser to force it to trust it) vs. allowing access to destination IPs that are not necessary for this service but ensures uninterrupted encryption end-to-end?

Thank you all,

Andres
_______________________________________________
AusNOG mailing list
AusNOG at lists.ausnog.net<mailto:AusNOG at lists.ausnog.net>
http://lists.ausnog.net/mailman/listinfo/ausnog
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20210816/0f435342/attachment.html>