Configure Security

Manage Firewall Policies

The Versa portal is preconfigured with default firewall rules. You cannot modify the default rules, but you can add new rules. When you create a rule for port-forwarding and IPsec route-based profiles, by default, Versa Portal creates a security rule that allows NAT and IPsec traffic, and the rule is displayed in the security rule list. For port forwarding, the security rule has a name in the format port_forwarding_rule_name_frd, and for an IPsec profile, the rule name is the same as the IPsec route-based profile name. You cannot edit or delete a system-generated default rule for port forwarding or for an IPsec profile. However, you can disable or reorder a default rule to change its priority.

To configure firewall settings:

1. In the Firewall Policies section, click Firewall Rules to open the Configuration > Security > Firewall Rules screen.
   
   
   
   Each rule displays a numbered circle indicating its position in the rule set. The circle color indicates whether a rule denies (red) or allows (green) traffic, or whether it applies one of the profiles listed in the Security Profile Definition section (purple). By default, the rules are displayed in grid view. To change the view to list, click the list view icon. To pin the view to grid or list for the login session, use the pin icon.
2. If needed, click Reorder Rules to enter rule reorder mode.
   1. To change a rule order, click the colored circle and drag the rule to a different spot in the rule set. The rule numbers are updated automatically.
   2. Click Publish Reordered Rules to save the changes to the Versa cloud.
3. If needed, click + Rule to add a firewall rule.
   
   
    
4. Enter information for the following fields.
    

   Field	Description
   Rule Name	Enter a name for the rule, and then slide the toggle to enable the rule.
   Description	Enter a text description for the rule. It can be a maximum of 63 characters.
   Match Criteria	Select the Protocol, Address, Application, URL, or DSCP tab to add information about that criteria type. For more information, see Apply Match Criteria for Firewall Rules, below.
   Scope (Group of Fields)
   Source Zone	Click the down arrow in the Please Select field. A popup window displays the configured interfaces and tunnels. Choose a source zone, and then click Continue. To create a tunnel, see Configure IPsec VPN Settings (Tunnels).
   Arrow	Choose the type of connection:  One-way  Two-way
   Destination Zone	Click the down arrow in the Please Select field. A popup window displays the configured interfaces and tunnels. Choose a destination zone, and then click Continue. To create a tunnel, see Configure IPsec VPN Settings (Tunnels).
   Action	Choose the Deny, Allow, or Apply Security Profile action. When you click Apply Security Profile, a popup window displays. Choose a level of security for each of the following: URLs Antivirus IPS IP Filter File Filter The security level can be Low, Standard, or Advanced. For IP filter and file filter, IP filter and file filter profiles.
   Logging	Configure log settings: None—Click to perform no logging. Custom—Click to configure logging to a customer log server. Based on the rule match, the instance may sent a large number of log messages. Please Select—If you select Custom, click the down arrow to select a log profile. Event—Select an option to log the data. Start—Log data at the start of each session. End—Log data at the end of each session. Both—Log data at the start and end of each session. Never—Never log data. To create a new custom flow logs profile, click. For more information, see Add Custom Logs Profile.

5. Click Add to save the changes. The new rule appears on the Firewall Rules screen.
6. Click Publish to save all firewall policies.

Apply Match Criteria for Firewall Rules

You can apply the following match criteria types in a security rule:

• Address
• Application
• DSCP
• Protocol
• URL

To specify the match criteria for a security rule:

1. To specify protocol criteria for a security rule:
   1. Select the Protocol tab to display the protocol window.
      
      
   2. In the Please Select field, select a protocol. Versa Portal automatically populates the next field with common port numbers.
   3. If needed, click the port number field and edit the port number range.
2. To specify address criteria for a security rule:
   1. Select the Address tab to display the address window.
      
      
   2. Click the toggle switch to enter the source or destination IP address. Then click Source.
      
      
   3. Enter a source IP address in CIDR format, and then click the icon. To remove an IP address from the list, click the icon.
      
      
   4. Click Continue
   5. Enter a destination IP address in CIDR format, and then click the icon. To remove an IP address from the list, click the icon.
      
      
   6. Click Continue
3. To specify application and application groups criteria for a security rule:
   1. Select the Application tab, and then click Click Here To Add or Modify Applications.
      
      
   2. The Firewall Rules > Add Application popup window displays. Select the Applications tab, then select the application to include in the match list, or type the name of the application in the search box and then select it from the search results. Then, click Add.
      
      
      • Click + Custom Applications to create a new custom application object. For more information, see Add Custom Applications.
   3. Select the Application Groups tab, and then select predefined application groups to include in the match list, or type the name of the application group in the search box and then select it from the search results. Then, click Add.
      
      
4. To specify URL criteria for a security rule:
   1. Select the URL tab to display the URL window.
      
      
   2. In the URL Category section, click Click Here To Add or Modify URLs to select URL categories.
      
      
      • To add custom URL category, click the  icon. For more information, see Add Custom URL Categories.
      • To configure settings for lookup URL, click the  icon. For more information, see Configure Lookup URL Settings.
   3. Click Add.
   4. In the URL Reputation section, click Click Here To Add or Modify to select URL reputations.
      
      
   5. Click Continue. In the Customize option, modify the URL reputation.
5. To specify DSCP criteria for a security rule, select the DSCP tab and then enter a DSCP value. DSCP allows you to classify and manage network traffic and to provide quality of service (QoS) in Layer 3 networks. It uses the 6-bit differentiated services code point (DSCP) field in the IP header to classify packets.
   
   

To edit or delete a rule:

1. In the Security > Rules tab, click a rule name to edit a rule.
2. In the Security > Rules tab, click the X to delete a rule.
3. Click Save to save the changes to the Versa cloud.

Configure Lookup URL Settings 

1. In the Configuration > Security Policy > Firewall Rules > Add Rules screen, select the URL tab in the Match Criteria section.
2. In the URL Category section, click Click Here To Add or Modify URLs to select URL categories, and then click Lookup URL.
   
   
3. In the Lookup URL search bar, enter a URL to look up the mappings to predefined or custom URL reputation and category. For example, enter www.google.com. The Lookup URL Result section displays information about the URL, including its category and reputation.
   
   
4. Click Clear to clear the look up URL result.
5. Click Back to return to the Add Rules screen.

Manage Security Profile Definitions

Security profile definitions contain the following components:

• Antivirus settings
• File filter
• Geo IP filter
• Intrusion Prevention System (IPS) settings
• URL settings, including a deny URL and allow URL

You can manage individual components from the Security screen. You can enable or disable all components with one click from the Inventory menu. See Manage Device License Inventory.

To manage the security profile components:

1. From the Configuration > Security tab, click the Security Policy to open the Security settings screen.
   
   
2. Slide the toggle to turn individual security components on or off.

Prerequisites for TLS Decryption

Before you create a TLS decryption rule:

• Create a profile for decryption. To decrypt the TLS traffic to inspect for malware, you upload the certificate and its associated private key. By default, Versa Portal provides a unique Versa-generated certificate and associated private key for every organization that you can download and install on the customer's end devices to connect to gateways. Alternately, you can use your own private key and certificate. To upload or download a certificate, see Upload a Certificate.
• For tenant organizations, you need to create a TLS decryption profile and rule. However, for provider organizations, default security rules are created and applied. You need to enable decryption and configure the URL category.
• Create a firewall rule without source and destination zones. The default destination port must be 44991 and 8080. If you have configured any other ports as part of captive portal, then you have to configure those ports as the destination ports for TLS decryption.

Configure TLS Decryption Profile

To decrypt or inspect traffic properties, you create an SSL decryption profile and associate it with a decryption policy rule. The decryption profile is applied to traffic that matches the decryption rule.

You can use two types of SSL proxies with a TLS decryption profile:

• SSL forward proxy—This is a transparent proxy that can decrypt and encrypt the SSL/TLS traffic between the client and the server. With a transparent proxy, neither the client nor the server knows about the proxy’s presence. Rather, the proxy acts as server towards the client and as a client towards the server.
  Whether to decrypt can be controlled through the decryption policy. When the client initiates an SSL/TLS handshake towards the server, the proxy applies the decryption policy to determine whether the traffic needs to be decrypted. If the policy action is to decrypt, the proxy uses the matching SSL profile to initiate the SSL handshake towards the server, and the policy inspects the server certificate and other SSL attributes from the SSL handshake stream. If the inspection is successful, the proxy completes the SSL handshake with server and generates a server certificate signed with the public key specified in the SSL proxy profile, and it resumes the SSL handshake towards the client. After the SSL handshake between the client and the proxy completes, the proxy is able to decrypt application traffic sent by the client, Once decrypted, the traffic can be examined by the other services in the firewall service chain before before it is encrypted and sent to the server.
• SSL full proxy—This proxy works in two modes, explicit and transparent:
  • Explicit—Processes SSL/TLS traffic destined to a specific IP address and a specific port. On the client, you configure the proxy IP address and the port. The explicit SSL full proxy works as follows:
    • The client connects to the configured proxy IP address and port and sends an HTTP Connect request.
    • The SSL full proxy parses the HTTP Connect request and extracts the domain that the client wants to connect to. The proxy uses the domain and other Layer 3 and Layer 4 parameters to locate a decryption policy. If the proxy finds a decryption policy, it decrypts or bypasses the SSL connection based on the action in the policy. If there is no policy, decryption is bypassed.
    • The SSL full proxy responds with a 200 OK message. When the proxy receives a client Hello message, if the policy decision was to decrypt, the SSL proxy responds with server Hello message and the remainder of the handshake message between the client and the proxy is exchanged.
    • After the handshake completes, the client does a GET or a POST on the connection.
    • The proxy parses the HTTP request and extracts the domain name and port from the URL. The proxy then performs a DNS resolution of that domain and opens a connection towards the resolved IP address using the source IP address and port from the configured SNAT pool referenced in the HTTP proxy profile.
    • After the connection is successful, the proxy initiates the SSL handshake with the server and then forwards the HTTP request to the server.
    • All the other services in the service chain, such as PS/IDS and antivirus, examine the decrypted stream to look for any threats, and they may drop the packet based on the outcome of their examination.
  • Transparent—Processes SSL/TLS traffic destined to any IP address but to a specific port. The transparent process works the same was as the explicit process, except for the DNS resolution process. Because the destination IP address is the actual address of the server, the proxy skips DNS resolution, and DNS resolution is done on the client, and the client opens the connection to the server IP address. The proxy uses the SNAT pool configured in the HTTPS proxy profile to performs source NATing.

To configure TLS decryption profile:

1. Click Configure in the left menu bar to open the Configure dashboard.
2. Hover over the instance in the honeycomb and click Configure to open the site information window.
3. Click the Security tab, and then click Decryption.
   
   
    
4. Click the icon in the Profiles section to create a profile for decryption.
   
   
    
5. In the Decryption Add window, enter information for the following fields.
   
   
    

   Field	Description
   Profile Name (Required)	Enter a name for the decryption profile.
   SSL Type	Select the decryption type to use with the profile: SSL Forward Proxy SSL Full Proxy—This proxy works in one of two modes, explicit or transparent. Explicit—Click to process SSL/TLS traffic destined to a specific IP address and a specific port. Transparent—Click to process SSL/TLS traffic destined to any IP address but to a specific port. Match Rules—Displays the names of the configured match rules. To add a rule, click the Add Rule icon to enter the following information in the Match Rule window. Rule Name (Required)—Enter a unique name for the rule. Routing Instance—Click the Routing Instance link. In the Routing Instance popup window, select a routing instance to associate with the match rule. Destination Ports (Required)—Click the Ports link. In the Destination Ports popup window, enter the port number to explicitly or transparently decrypt traffic originating from that port. Destination IP Prefix—For transparent decryption, click the Prefix link. In the Destination IP Prefix popup window, enter destination IP address prefix to match for connections. Destination IP Address—For explicit decryption, click the Address link. In the Destination IP Address popup window, enter destination IP address to match for connections.
   Start TLS	For SSL forward proxy decryption, select how to start the TLS connection: IMAP POP3 SMTP
   User Extended Master Secret	Click to use the TLS extended master secret extension, This option helps to prevent man-in-the-middle attacks.
   CA Certificate	Click to upload a certificate and its associated private key. In the Certificate List popup window, select the certificate and then click Continue. If you need to upload your own certificate, you can add the key and then add the certificate for the provider organization. You cannot upload your own certificate for tenant organizations.
   TLS Inspection
   Restrict Certificate Extension	Click to restrict certificate extensions.
   Certificate Checks (Group of Fields)
   Expired Certificate	Select the action to take when the server certificate expires: Alert—Allow the decrypt session and generate an entry in the SSL log. Allow—Allow the decrypt session without generating an entry in the SSL log. Drop packet—The browser waits for a response from the server and then drops the packets. It is not possible to determine whether the packet was dropped because of a delayed response from the server or because a firewall blocked access to the website. Drop session—The browser waits for a response from the server and drops the session. It is not possible to determine whether the session was dropped because of a delayed response from the server or because a firewall blocked access to the website. Reject session—The browser displays an alert and resets the connection to the server. It is not possible to determine whether this occurred because of a delayed response from the server or because a firewall blocked access to the website.
   Untrusted Issuer	Select the action to imply when the certificate is from an untrusted issuer: Alert—Allow the decrypt session and generate an entry in the SSL log. Allow—Allow the decrypt session without generating an entry in the SSL log. Drop packet—The browser waits for a response from the server and then drops the packets. It is not possible to determine whether the packet was dropped because of a delayed response from the server or because a firewall blocked access to the website. Drop session—The browser waits for a response from the server and drops the session. It is not possible to determine whether the session was dropped because of a delayed response from the server or because a firewall blocked access to the website. Reject session—The browser displays an alert and resets the connection to the server. It is not possible to determine whether this occurred because of a delayed response from the server or because a firewall blocked access to the website.
   Mode Checks (Group of Fields)
   Unsupported Cipher	Select the action to take when the decryption encounters an unsupported cipher: Alert—Allow the decrypt session and generate an entry in the SSL log. Allow—Allow the decrypt session without generating an entry in the SSL log. Drop packet—The browser waits for a response from the server and then drops the packets. It is not possible to determine whether the packet was dropped because of a delayed response from the server or because a firewall blocked access to the website. Drop session—The browser waits for a response from the server and drops the session. It is not possible to determine whether the session was dropped because of a delayed response from the server or because a firewall blocked access to the website. Reject—The browser displays an alert and resets the connection to the server. It is not possible to determine whether this occurred because of a delayed response from the server or because a firewall blocked access to the website.
   Unsupported Key Length	Select the action to take when the decryption encounters an unsupported key length: Alert—Allow the decrypt session and generate an entry in the SSL log. Allow—Allow the decrypt session without generating an entry in the SSL log. Drop packet—The browser waits for a response from the server and then drops the packets. It is not possible to determine whether the packet was dropped because of a delayed response from the server or because a firewall blocked access to the website. Drop session—The browser waits for a response from the server and drops the session. It is not possible to determine whether the session was dropped because of a delayed response from the server or because a firewall blocked access to the website. Reject—The browser displays an alert and resets the connection to the server. It is not possible to determine whether this occurred because of a delayed response from the server or because a firewall blocked access to the website.
   Unsupported Version	Select the action to take when the decryption encounters an unsupported CA version: Alert—Allow the decrypt session and generate an entry in the SSL log. Allow—Allow the decrypt session without generating an entry in the SSL log. Drop packet—The browser waits for a response from the server and then drops the packets. It is not possible to determine whether the packet was dropped because of a delayed response from the server or because a firewall blocked access to the website. Drop session—The browser waits for a response from the server and drops the session. It is not possible to determine whether the session was dropped because of a delayed response from the server or because a firewall blocked access to the website. Reject—The browser displays an alert and resets the connection to the server. It is not possible to determine whether this occurred because of a delayed response from the server or because a firewall blocked access to the website.
   Minimum Supported Key Length	Enter the minimum RSA key length, in bits. Range: 512 through 65535 Default: 512
   TLS Protocol	Select the TLS protocol: Minimum Version—Select the minimum version of TLS protocol that is supported. The minimum version must be the same as or earlier than the maximum version. TLS 1.1 TLS 1.2 TLS 1.3 Maximum Version—Select the maximum version of TLS protocol that is supported. The maximum version must be the same as or later than the minimum version. The options displayed depend on the version you select in the Minimum Version field. For example, if the minimum version is TLS 1.1, the options TLS 1.1, TLS 1.2, and TLS 1.3 are displayed. If the minimum version is TLS 1.2, the options TLS 1.2 and TLS 1.3 are displayed.
   Key Exchange Algorithms	When you select minimum and maximum TLS versions and the version is not TLS 1.3, select one or more key exchange algorithms for the SSL connection: ECDHE—Elliptic-curve Diffie–Hellman Key Exchange RSA—Rivest–Shamir–Adleman algorithm
   Encryption Algorithms	Select an encryption algorithm to use: AES-128-CBC—AES CBC encryption algorithm with 128-bit key AES-128-GCM—AES GCM encryption algorithm with 128-bit key AES-256-CBC—AES CBC encryption algorithm with 256-bit key AES-256-GCM—AES GCM encryption algorithm with 256-bit key Camellia-256-CBC—Camellia encryption algorithm with 256-bit key Chacha20-Poly1305—ChaCha stream cipher and Poly1305 authenticator Seed CBC—TLS RSA with seed CBC
   Authentication Algorithms	Click to have the selected LEF profile be the default LEF profile: SHA—Secure Hash Algorithm SHA-256—Secure Hash Algorithm 2 with 256-bit digest SHA-384—Secure Hash Algorithm 2 with 384-bit digest
   Cipher Suites	Select a TLS cipher suite. If you select a cipher suite, it must be consistent with the selected key exchange, encryption, and authentication algorithms. If you do not configure cipher suites, all cipher suites matching the selected the key exchange, encryption, and authentication algorithms are selected by default. TLS-AES-128-GCM-SHA256 TLS-AES-256-GCM-SHA384 TLS-CHACHA20-POLY1305-SHA256 TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256 TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384 TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256 TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256 TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256 TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384 TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256 TLS-RSA-WITH-AES-128-CBC-SHA TLS-RSA-WITH-AES-128-CBC-SHA256 TLS-RSA-WITH-AES-128-GCM-SHA256 TLS-RSA-WITH-AES-256-CBC-SHA TLS-RSA-WITH-AES-256-CBC-SHA256 TLS-RSA-WITH-AES-256-GCM-SHA384 TLS-RSA-WITH-CAMELLIA-256-CBC-SHA TLS-RSA-WITH-SEED-CBC-SHA
   Logging (Group of Fields)
   None	Click to perform no logging.
   Default	Click to use default logging.
   Custom	Click to configure logging to a customer log server. Based on the rule match, the instance may send many log messages.
   Please Select	If you select Custom, click the down arrow to select a log profile. To create a new custom flow logs profile, click . For more information, see Add Custom Logs Profile.

6. Click Add.

Configure TLS Decryption Rule

In a TLS ecryption rule, you define the traffic of interest, and for matching traffic you define whether to decrypt the traffic, inspect the traffic, or both decrypt and inspect it. Create a TLS decryption rule without source and destination zones, or only configure the destination zone.

To configure TLS decryption rule:

1. Click Configure in the left menu bar to open the Configure dashboard.
2. Hover over the instance in the honeycomb and click Configure to open the site information window.
3. Click the Security tab, and then click Decryption.
   
   
    
4. Click the icon in the TLS Decryption section to create a rule for decryption.
   
   
   
   Each rule displays a numbered circle indicating its position in the rule set. Circle color indicates whether a rule decrypt (red) or decrypt bypass (green) traffic. By default, the rules are displayed in grid view. To change the view to list, click the list view icon. To pin the view to grid or list for the login session, use the pin icon.
5. If needed, click Reorder Rules to enter rule reorder mode.
   1. To change a rule order, click the colored circle and drag the rule to a different spot in the rule set. The rule numbers are updated automatically.
   2. Click Publish Reordered Rules to save the changes to the Versa cloud.
6. In the Decryption Add window, enter information for the following fields.
   
   
    

   Field	Description
   Rule Name (Required)	Enter a name for the decryption rule. Slide the toggle to enable or disable rules.
   Description	Enter a text description for the rule. It can be a maximum of 63 characters.
   Match Criteria	Click Protocol, Address, or URL tab to add details for that criteria type. For more information, see Apply Match Criteria for TLS Decryption Rules, below.
   Scope (Group of Fields)	Select the traffic source and destination.
   Source	Click the down arrow in the Please Select list. Select the source network security zone to which to apply the decryption policy rule to traffic coming from any interface in the zone, and then click Continue. Untrust (Internet)—Select for internet-facing WAN interfaces. Wired LAN—Select for LAN interfaces that are controlled by enterprises. Wireless LAN—Select for LAN interfaces that are on wireless networks.
   Arrow	Choose a  one-way or  two-way connection.
   Destination	Destination zone is not applicable.
   Action	Select the action to take on the traffic: Decrypt—Click to enable decryption. Decrypt Bypass—Click to bypass the decryption of SSL traffic that matches the predefined actions.
   Select Profile	If the action selected is decrypt, select the decryption profile.

7. Click Add.

Apply Match Criteria for TLS Decryption Rules

You can use the following match criteria types in a TLS decryption rule:

• Protocol
• Address
• URL

To specify match criteria for a TLS decryption rule:

1. To specify protocol criteria for a TLS decryption rule:
   1. Select the Protocol tab to display the protocol window.
      
      
       
   2. In the Please Select field, select a protocol. Versa Portal automatically populates the next field with common port numbers.
   3. If needed, click the port number field and edit the port number range.
2. To specify address criteria for a TLS decryption rule:
   1. Select the Address tab to display the address window.
      
      
   2. Click the toggle switch to enter the source or destination IP address. Then click Source.
      
      
       
   3. Enter a source IP address in CIDR format, and then click the icon. To remove an IP address from the list, click the icon.
      
      
   4. Click Continue
   5. Enter a destination IP address in CIDR format, and then click the icon. To remove an IP address from the list, click the icon.
      
      
   6. Click Continue
3. To specify URL criteria for a TLS decryption rule:
   1. Select the URL tab to display the URL window.
      
      
   2. Enter the URL pattern, for example, https://google.*. You can save the URL patterns in .txt file format and add multiple .txt files separated by a comma. Click Browse File to add te file.
   3. In the URL Category section, select the URL categories to decrypt. Versa instances support a wide range of predefined URL categories that you can apply in different types of security policies. You can look up URL categories in the database of predefined URL database to determine the URL category. The predefined URL database is updated daily or in real time as part of security package (SPack) updates.
      
      
   4. Click Add.
   5. In the URL Reputation section, select the URL reputation to decrypt and click Continue.