Add a Decryption Rule to a Firewall Policy

Decryption rules contain a set of criteria against which a network packet is matched and decrypted.

Before you can create a decryption rule, you must complete these tasks:

Set up certificate authentication using the Oracle Cloud Infrastructure Vault service to use in a mapped secret.
Create a mapped secret to use in the decryption rule.
Create a decryption profile to use when decrypting traffic.

If you choose to decrypt, you then choose a decryption profile and mapped secret to apply when decrypting traffic. You configure decryption profiles and mapped secrets in the policy before you construct the rule.

You can have a maximum of 1,000 decryption rules for each policy. By default, each new rule you create becomes the first in the list. You can change the order of priority.

1. Open the navigation menu, and select Identity & Security. Under Firewalls, select Network Firewall policies.
2. Select the compartment that contains the firewall policy that you want to add a decryption rule to.
3. Select the firewall policy.
4. On the details page, select the Rules tab.
5. Select Create decryption rule.
6. In the Name field, enter a name for the rule. Avoid entering confidential information.
7. (Optional) In the Description field, enter a brief summary of the decryption rule.
  Use this field to provide details about the decryption rule to help other users understand its purpose or configuration. You can enter up to 1,000 characters and can edit this field at any time.
8. Under Match condition, specify the source and destination addresses that must match for the decryption rule to apply.
  
  Under Source addresses:
  
  Select Any source address matches the rule if the rule applies to traffic from any source address.
  
  Select Create or select a list of source addresses to match the rule to apply the rule only to traffic from specific source addresses, then select an existing address list or create a new one by selecting Create address list from the Actions menu. To learn how to create an address list, see Create an Address List.
  
  Under Destination addresses:
  
  Select Any destination address matches the rule if the rule applies to traffic from any destination address.
  
  Select Create or select a list of destination addresses to match the rule to apply the rule only to traffic from specific destination addresses, then select an existing address list or create a new one by selecting Create address list from the Actions menu. To learn how to create an address list, see Create an Address List.
9. Under Rule action, specify the action that you want to take if the match condition is met:
  
  Select Decrypt traffic with SSL inbound inspection to decrypt and inspect SSL/TLS traffic sent to servers protected by the firewall.
  
  Select Decrypt traffic with SSL forward proxy to decrypt and inspect SSL/TLS traffic sent from internal clients to external servers.
  
  Select Do not decrypt when the traffic matches the rule but remains encrypted.
10. If you select either decryption action, configure the required decryption resources:
  
  From the Decryption profile list, select the profile that defines the checks applied to the decrypted traffic. Select Create new if the required profile doesn't exist.
  
  From the Mapped secret list, select the secret to use with the decryption rule. Select Create new if the required mapped secret doesn't exist. You can select multiple mapped secrets for a decryption rule.
11. Under Rule order, select the position of the rule in relation to other decryption rules in the policy. The firewall applies the decryption rules in the specified order from first to last.
  
  Select First rule in list to evaluate this rule before the existing decryption rules.
  
  Select Last rule in list to evaluate this rule after the existing decryption rules.
  
  Note
  
  Custom position is enabled only if you create more than one decryption rule. If you select it, specify whether you want this rule to come before an existing rule or after an existing rule. Then, specify the rule that you want the new rule to come before or after.
12. Select Create.

Use the network-firewall decryption-rule create command and required parameters to create a decryption rule:

oci network-firewall decryption-rule create --name my_decryption_rule --network-firewall-policy-id network firewall policy OCID
--decryption-profile decryption_profile --action DECRYPT --condition '[{"sourceAddress":"IP_address"}]' ...[OPTIONS]

For a complete list of parameters and values for CLI commands, see the CLI Command Reference.

Run the CreateDecryptionRule operation to create a decryption rule.

Oracle Cloud Infrastructure Documentation

Add a Decryption Rule to a Firewall Policy