Oracle Cloud Infrastructure Documentation

Create a Decryption Profile

Create decryption profiles to control how SSL forward proxy and SSL inbound inspection perform session mode checks, server checks, and failure checks. You can create a maximum of 500 decryption profiles in each policy.

Before you can create a decryption profile, you must create a mapped secret.
Important

Some names are reserved by Palo Alto Networks® and can't be used.
    1. Open the navigation menu, and select Identity & Security. Under Firewalls, select Network Firewall policies.
    2. Select that compartment that contains the policy that you want to create the application in.
    3. Select the policy.
    4. On the details page, select the TLS decryption tab.
    5. From within the Decryption profiles table, select Create decryption profile.
    6. In the Name field, enter the name for the decryption profile. Avoid entering confidential information.
    7. (Optional) In the Description field, enter a brief summary of the decryption profile.
      Use this field to provide details about the decryption profile to help other users understand its purpose or configuration. You can enter up to 1,000 characters and can edit this field at any time.
    8. Under Decryption profile type, select one of the following options:
      • Select SSL Forward Proxy to decrypt and inspect outbound SSL/TLS traffic from internal clients to external servers.
      • Select SSL Inbound Inspection to decrypt and inspect inbound SSL/TLS traffic sent to servers protected by the firewall.
    9. Specify the Server Certificate Verification, Unsupported mode checks, and Failure checks that you want the decryption profile to perform on decrypted traffic.
    10. Select Create.

  • Use the network-firewall decryption-profile create command and required parameters to create a decryption profile:

    oci network-firewall decryption-profile create --name my_decryption_profile --network-firewall-policy-id network firewall policy OCID --compartment-id compartment OCID
--type SSL_INBOUND_INSPECTION --vault-secret-ID secret OCID --version-number integer ...[OPTIONS]

    For a complete list of parameters and values for CLI commands, see the CLI Command Reference.

  • Run the CreateDecryptionProfile operation to create a decryption profile.