Configure Security

Manage Firewall Policies

The Titan portal is preconfigured with default firewall rules. You cannot modify the default rules, but you can add new rules. When you create a rule for port-forwarding and IPsec route-based profiles, by default, Titan Portal creates a security rule that allows NAT and IPsec traffic, and the rule is displayed in the security rule list. For port forwarding, the security rule has a name in the format port_forwarding_rule_name_frd, and for an IPsec profile, the rule name is the same as the IPsec route-based profile name. You cannot edit or delete a system-generated default rule for port forwarding or for an IPsec profile. However, you can disable or reorder a default rule to change its priority.

To configure firewall settings:

1. In the Firewall Policies section, click Firewall Rules to open the Configuration > Security > Firewall Rules screen.
   
   
   
   Each rule displays a numbered circle indicating its position in the rule set. The circle color indicates whether a rule denies (red) or allows (green) traffic, or whether it applies one of the profiles listed in the Security Profile Definition section (purple). By default, the rules are displayed in grid view. To change the view to list, click the list view icon. To pin the view to grid or list for the login session, use the pin icon.
2. If needed, click Reorder Rules to enter rule reorder mode.
   1. To change a rule order, click the colored circle and drag the rule to a different spot in the rule set. The rule numbers are updated automatically.
   2. Click Publish Reordered Rules to save the changes to the Titan cloud.
3. If needed, click + Rule to add a firewall rule.
   
   
    
4. Enter information for the following fields.
    

   Field	Description
   Rule Name	Enter a name for the rule, and then slide the toggle to enable the rule.
   Description	Enter a text description for the rule. It can be a maximum of 63 characters.
   Match Criteria	Select the Protocol, Address, Hostname, Application, URL, DSCP, or User and Group tab to add information about that criteria type. For more information, see Apply Match Criteria for Firewall Rules, below.
   Scope (Group of Fields)
   Source Zone	Click the down arrow in the Please Select field. A popup window displays the configured interfaces and tunnels. Choose a source zone, and then click Continue. To create a tunnel, see Configure IPsec VPN Settings.
   Arrow	Choose the type of connection: One-way Two-way
   Destination Zone	Click the down arrow in the Please Select field. A popup window displays the configured interfaces and tunnels. Choose a destination zone, and then click Continue. To create a tunnel, see Configure IPsec VPN Settings.
   Action	Choose the Deny, Allow, or Apply Security Profile action. When you click Apply Security Profile, a popup window displays. Choose a level of security for each of the following: URLs Antivirus IPS IP Filter File Filter The security level can be Low, Standard, or Advanced. For IP filter and file filter, IP filter and file filter profiles.
   Logging	Configure log settings: None—Click to perform no logging. Default—Click to use default logging. Custom—Click to configure logging to a customer log server. Based on the rule match, the device may sent a large number of log messages.   Please Select—If you select Custom, click the down arrow to select a log profile. Event—Select an option to log the data. Start—Log data at the start of each session. End—Log data at the end of each session. Both—Log data at the start and end of each session. Never—Never log data. To create a new custom flow logs profile, click . For more information, see Add Custom Logs Profile.

5. Click Add to save the changes. The new rule appears on the Firewall Rules screen.
6. Click Publish to save all firewall policies.

Click X in the icon to remove a rule, then click Publish.

Click the following on the Security > Firewall Rules: New Rules screen to view default firewall rules:

• Allow_From_SDWAN
• Allow_To_SDWAN
• Default_Security_Rule
• Default_security_wifi (if the device supports WiFi)

Note that you cannot edit a default rule.

The following video describes how to manage next-generation firewall policies.

Create a Firewall Rule for SASE Gateway

To create a firewall rule for Secure Access Service Edge (SASE) gateway:

1. In the Firewall Policies section, click Firewall Rules to open the Configuration > Security > Firewall Rules screen.
   
   
   
   Each rule displays a numbered circle indicating its position in the rule set. The color of the circle indicates whether a rule denies traffic (red), allows traffic (green), or whether a rule applies one of the profiles listed in the Security Profile Definition section (purple). By default, the rules are displayed in grid view. To change the view to list, click the list view icon. To pin the view to grid or list for the login session, use the pin icon.
2. If needed, click Reorder Rules to enter rule reorder mode.
   1. To change a rule order, click the colored circle and drag the rule to a different spot in the rule set. The rule numbers are updated automatically.
   2. Click Publish Reordered Rules to save the changes to the Titan cloud.
3. Click +Rule to add a new firewall rule, and then enter information for the following fields.
   
   
    

   Field	Description
   Rule Name	Enter a name for the rule, and then slide the toggle to enable the rule.
   Description	Enter a text description for the rule. It can be a maximum of 63 characters.
   Match Criteria	Click Protocol, Address, Hostname, Application, URL, DSCP, or User and Group to add details for that criteria type. For more information, see Apply Match Criteria for Firewall Rules, below.
   	Click the down arrow in the Please Select list to select the protocol.
   Scope (Group of Fields)
   Source Zone	Click the down arrow in the Please Select list. A popup window displays the zones that classify the traffic flows coming to the gateway from various sources. Select a source zone, and then click Continue. Host—Click to match the traffic that originates from device itself (that is, non-transient traffic). Remote Client—Click to use as the ingress zone for the traffic coming from VSA clients. SD-WAN—Click for traffic coming to the gateway over overlay tunnels from remote SD-WAN branches. Trust (LAN)—Click to use LAN interfaces that are controlled by enterprises. Untrust (Internet)—Click to use for internet-facing WAN interfaces.
   Arrow	Choose a one-way or two-way connection.
   Destination Zone	Click the down arrow in the Please Select list. A popup window displays the zones that classify the traffic flows coming to the gateway from various sources. Select a destination zone, and then click Continue.   Host—Click to match the traffic that originates from device itself (that is, non-transient traffic). Remote Client—Click to use as the egress zone for the traffic coming from VSA clients. SD-WAN—Click for traffic coming to the gateway over overlay tunnels from remote SD-WAN branches. Trust (LAN)—Click to use LAN interfaces that are controlled by enterprises. Untrust (Internet)—Click to use for internet-facing WAN interfaces.
   Action	Choose Deny, Allow, or Apply Security Profile. When you click Apply Security Profile, a popup window displays. Choose a level of security for each of the following: URLs Antivirus IPS IP Filter File Filter The security level can be Low, Standard, or Advanced. For IP filter and file filter, IP filter and file filter profiles.
   Logging	Click to configure logging: None—Click to perform no logging. Default—Click to use default logging. Custom—Click to configure logging to a customer log server. Based on the rule match, the device may sent a large number of log messages. Please Select—If you select Custom, click the down arrow to select a log profile. Event—Select an option to log the data. Start—Log data at the start of each session. End—Log data at the end of each session. Both—Log data at the start and end of each session. Never—Never log data. To create a new custom flow logs profile, click . For more information, see Add Custom Logs Profile.

4. Click Add to save the changes. The new rule appears in the Firewall Rules screen.
5. Click Publish to save all firewall policies.

Click X in the icon to remove a rule, and then click Publish.

Default Firewall Rules for SASE Gateways

Titan Portal is preconfigured with default firewall rules for SASE gateways. You cannot edit or delete a system-generated default rule. However, you can disable a default rule and reorder a default rule to change its priority. You can also add a new rule.

When you upgrade a SASE gateway license, new default rules are not created, and the default rules present in the previous version are not deleted.

If you use Easy Quick Picks with the SASE gateway default security rule, the default security rules are lost.

The following are system-generated default firewall rule for SASE gateway, which you view by clicking Security > Security Policy > Firewall Rules:

• Allow From Hostbound On LAN
• Allow From SD-WAN
• Allow To SD-WAN
• Allow VSA Authentication
• Default Security Rule
• Default Security WiFi (for devices that support WiFi)
• Deny Remote Users To SD-WAN
• Remote User To Internet Block
• SWG (secure web gateway) Rule
• VSA (Versa secure access) Rule
• VSA SWG Rule

For provider organizations, Titan Portal creates the default firewall rule Allow VSA Authentication to allow captive portal traffic.

For a tenant user, the following default firewall rules are provided depending on the license type:

Apply Match Criteria for Firewall Rules

You can apply the following match criteria types in a security rule:

• Address
• Application
• DSCP
• Hostname
• Protocol
• URL
• User and Group

To specify the match criteria for a security rule:

1. To specify protocol criteria for a security rule:
   1. Select the Protocol tab to display the protocol window.
      
      
   2. In the Please Select field, select a protocol. Titan Portal automatically populates the next field with common port numbers.
   3. If needed, click the port number field and edit the port number range.
2. To specify address criteria for a security rule:
   1. Select the Address tab to display the address window.
      
      
   2. Click the toggle switch to enter the source or destination IP address. Then click Source.
      
      
   3. Enter a source IP address in CIDR format, and then click the icon. To remove an IP address from the list, click the icon.
      
      
   4. Click Continue
   5. Enter a destination IP address in CIDR format, and then click the icon. To remove an IP address from the list, click the icon.
      
      
   6. Click Continue
3. To specify hostname criteria for a security rule:
   1. Select the Hostname tab to display the Hostname window.
      
      
   2. Click the toggle switch to enter the source or destination hostname. Then click Source.
      
      
   3. Enter a source hostname, and then click the icon. To remove a hostname from the list, click the icon.
      
      
   4. Click Continue
   5. Enter a destination hostname, and then click the icon. To remove a hostname from the list, click the icon.
      
      
   6. Click Continue.
4. To specify application and application groups criteria for a security rule:
   1. Select the Application tab, and then click Click Here To Add or Modify Applications.
      
      
   2. The Firewall Rules > Add Application popup window displays. Select the Applications tab, then select the application to include in the match list, or type the name of the application in the search box and then select it from the search results. Then, click Add.
      
      
      • Click + Custom Applications to create a new custom application object. For more information, see Add Custom Applications.
   3. Select the Application Groups tab, and then select predefined application groups to include in the match list, or type the name of the application group in the search box and then select it from the search results. Then, click Add.
      
      
5. To specify URL criteria for a security rule:
   1. Select the URL tab to display the URL window.
      
      
   2. In the URL Category section, click Click Here To Add or Modify URLs to select URL categories.
      
      
      • To add a new custom URL category object, click the  icon. For more information, see Add Custom URL Categories.
      • Click the  icon to enter a URL and to look up the mappings to predefined and custom URL reputations and categories. For more information, see Configure Look Up URL Settings.
   3. Click Add.
   4. In the URL Reputation section, click Click Here To Add or Modify to select URL reputations.
      
      
   5. Click Continue. In the Customize option, modify the URL reputation.
6. To specify DSCP criteria for a security rule, select the DSCP tab and then enter a DSCP value. DSCP allows you to classify and manage network traffic and to provide quality of service (QoS) in Layer 3 networks. It uses the 6-bit differentiated services code point (DSCP) field in the IP header to classify packets.
   
   
    
7. By default, security enforcement is applied to all users and user groups. To change these settings, select the User and Group tab and do the following:
   
   
   1. Select a user to bind with the security policy:
      • Any
      • Known
      • Selected
      • Unknown
   2. To select specific user and group, click Selected and do the following:
      1. Select an LDAP user group profile in the Select LDAP list.
      2. Use the search box to search for the user and group, or click the checkbox next to the user and group name.
         
         
   3. Click Add.

To edit or delete a rule:

1. In the Security > Rules tab, click a rule name to edit a rule.
2. In the Security > Rules tab, click the X to delete a rule.
3. Click Save to save the changes to the Titan cloud.

Configure Look Up URL Settings

1. In the Configuration > Security Policy > Firewall Rules > Add Rules screen, select the URL tab in the Match Criteria section.
2. In the URL Category section, click Click Here To Add or Modify URLs to select URL categories, and then click Look Up URL.
   
   
3. In the Look Up URL search bar, enter a URL to look up the mappings to predefined or custom URL reputation and category. For example, enter www.google.com. The Look Up URL Result section displays information about the URL, including its category and reputation.
   
   
4. Click Clear to clear the look up URL result.
5. Click Back to return to the Add Rules screen.

Manage Security Profile Definitions

Security profile definitions contain three components:

• Antivirus settings
• Intrusion Prevention System (IPS) settings
• URL settings, including a deny URL and allow URL

You can manage individual components from the Security screen. You can enable or disable all components with one click from the Inventory menu. See Manage Device License Inventory.

To manage the security profile components:

1. From the Configuration > Security tab, click the Security Policy to open the Security settings screen.
   
   
    
2. Slide the toggle to turn individual security components on or off.

Prerequisites for TLS Decryption

Before you create a TLS decryption rule:

• Create a profile for decryption. To decrypt the TLS traffic to inspect for malware, you upload the certificate and its associated private key. By default, Titan provides a unique Versa-generated certificate and associated private key for every organization that you can download and install on the customer's end devices to connect to gateways. Alternately, you can use your own private key and certificate. To upload or download a certificate, see Upload a Certificate.
• For tenant organizations, you need to create a TLS decryption profile and rule. However, for provider organizations, default security rules are created and applied. You need to enable decryption and configure the URL category.
• Create a firewall rule without source and destination zones. The default destination port must be 44991 and 8080. If you have configured any other ports as part of captive portal, then you have to configure those ports as the destination ports for TLS decryption.

Configure TLS Decryption Profile

To decrypt or inspect traffic properties, you create an SSL decryption profile and associate it with a decryption policy rule. The decryption profile is applied to traffic that matches the decryption rule.

You can use two types of SSL proxies with a TLS decryption profile:

• SSL forward proxy—This is a transparent proxy that can decrypt and encrypt the SSL/TLS traffic between the client and the server. With a transparent proxy, neither the client nor the server knows about the proxy’s presence. Rather, the proxy acts as server towards the client and as a client towards the server.
  Whether to decrypt can be controlled through the decryption policy. When the client initiates an SSL/TLS handshake towards the server, the proxy applies the decryption policy to determine whether the traffic needs to be decrypted. If the policy action is to decrypt, the proxy uses the matching SSL profile to initiate the SSL handshake towards the server, and the policy inspects the server certificate and other SSL attributes from the SSL handshake stream. If the inspection is successful, the proxy completes the SSL handshake with server and generates a server certificate signed with the public key specified in the SSL proxy profile, and it resumes the SSL handshake towards the client. After the SSL handshake between the client and the proxy completes, the proxy is able to decrypt application traffic sent by the client, Once decrypted, the traffic can be examined by the other services in the firewall service chain before before it is encrypted and sent to the server.
• SSL full proxy—This proxy works in two modes, explicit and transparent:
  • Explicit—Processes SSL/TLS traffic destined to a specific IP address and a specific port. On the client, you configure the proxy IP address and the port. The explicit SSL full proxy works as follows:
    • The client connects to the configured proxy IP address and port and sends an HTTP Connect request.
    • The SSL full proxy parses the HTTP Connect request and extracts the domain that the client wants to connect to. The proxy uses the domain and other Layer 3 and Layer 4 parameters to locate a decryption policy. If the proxy finds a decryption policy, it decrypts or bypasses the SSL connection based on the action in the policy. If there is no policy, decryption is bypassed.
    • The SSL full proxy responds with a 200 OK message. When the proxy receives a client Hello message, if the policy decision was to decrypt, the SSL proxy responds with server Hello message and the remainder of the handshake message between the client and the proxy is exchanged.
    • After the handshake completes, the client does a GET or a POST on the connection.
    • The proxy parses the HTTP request and extracts the domain name and port from the URL. The proxy then performs a DNS resolution of that domain and opens a connection towards the resolved IP address using the source IP address and port from the configured SNAT pool referenced in the HTTP proxy profile.
    • After the connection is successful, the proxy initiates the SSL handshake with the server and then forwards the HTTP request to the server.
    • All the other services in the service chain, such as PS/IDS and antivirus, examine the decrypted stream to look for any threats, and they may drop the packet based on the outcome of their examination.
  • Transparent—Processes SSL/TLS traffic destined to any IP address but to a specific port. The transparent process works the same was as the explicit process, except for the DNS resolution process. Because the destination IP address is the actual address of the server, the proxy skips DNS resolution, and DNS resolution is done on the client, and the client opens the connection to the server IP address. The proxy uses the SNAT pool configured in the HTTPS proxy profile to performs source NATing.

To configure TLS decryption profile:

1. Click Configure in the left menu bar to open the Configure dashboard.
2. Hover over the device in the honeycomb and click Configure to open the site information window.
3. Click the Security tab, and then click Decryption.
   
   
    
4. Click the icon in the Profiles section to create a profile for decryption.
   
   
    
5. In the Decryption Add window, enter information for the following fields.
   
   
    

   Field	Description
   Profile Name (Required)	Enter a name for the decryption profile.
   SSL Type	Select the decryption type to use with the profile: SSL Forward Proxy SSL Full Proxy—This proxy works in one of two modes, explicit or transparent. Explicit—Click to process SSL/TLS traffic destined to a specific IP address and a specific port. Transparent—Click to process SSL/TLS traffic destined to any IP address but to a specific port. Match Rules—Displays the names of the configured match rules. To add a rule, click the Add Rule icon to enter the following information in the Match Rule window. Rule Name (Required)—Enter a unique name for the rule. Routing Instance—Click the Routing Instance link. In the Routing Instance popup window, select a routing instance to associate with the match rule.   Destination Ports (Required)—Click the Ports link. In the Destination Ports popup window, enter the port number to explicitly or transparently decrypt traffic originating from that port.   Destination IP Prefix—For transparent decryption, click the Prefix link. In the Destination IP Prefix popup window, enter destination IP address prefix to match for connections. Destination IP Address—For explicit decryption, click the Address link. In the Destination IP Address popup window, enter destination IP address to match for connections.
   Start TLS	For SSL forward proxy decryption, select how to start the TLS connection: IMAP POP3 SMTP
   User Extended Master Secret	Click to use the TLS extended master secret extension, This option helps to prevent man-in-the-middle attacks.
   CA Certificate	Click to upload a certificate and its associated private key. In the Certificate List popup window, select the certificate and then click Continue.   If you need to upload your own certificate, you can add the key and then add the certificate for the provider organization. You cannot upload your own certificate for tenant organizations.
   TLS Inspection
   Restrict Certificate Extension	Click to restrict certificate extensions.
   Certificate Checks (Group of Fields)
   Expired Certificate	Select the action to take when the server certificate expires: Alert—Allow the decrypt session and generate an entry in the SSL log. Allow—Allow the decrypt session without generating an entry in the SSL log. Drop packet—The browser waits for a response from the server and then drops the packets. It is not possible to determine whether the packet was dropped because of a delayed response from the server or because a firewall blocked access to the website. Drop session—The browser waits for a response from the server and drops the session. It is not possible to determine whether the session was dropped because of a delayed response from the server or because a firewall blocked access to the website. Reject session—The browser displays an alert and resets the connection to the server. It is not possible to determine whether this occurred because of a delayed response from the server or because a firewall blocked access to the website.
   Untrusted Issuer	Select the action to imply when the certificate is from an untrusted issuer: Alert—Allow the decrypt session and generate an entry in the SSL log. Allow—Allow the decrypt session without generating an entry in the SSL log. Drop packet—The browser waits for a response from the server and then drops the packets. It is not possible to determine whether the packet was dropped because of a delayed response from the server or because a firewall blocked access to the website. Drop session—The browser waits for a response from the server and drops the session. It is not possible to determine whether the session was dropped because of a delayed response from the server or because a firewall blocked access to the website. Reject session—The browser displays an alert and resets the connection to the server. It is not possible to determine whether this occurred because of a delayed response from the server or because a firewall blocked access to the website.
   Mode Checks (Group of Fields)
   Unsupported Cipher	Select the action to take when the decryption encounters an unsupported cipher: Alert—Allow the decrypt session and generate an entry in the SSL log. Allow—Allow the decrypt session without generating an entry in the SSL log. Drop packet—The browser waits for a response from the server and then drops the packets. It is not possible to determine whether the packet was dropped because of a delayed response from the server or because a firewall blocked access to the website. Drop session—The browser waits for a response from the server and drops the session. It is not possible to determine whether the session was dropped because of a delayed response from the server or because a firewall blocked access to the website. Reject—The browser displays an alert and resets the connection to the server. It is not possible to determine whether this occurred because of a delayed response from the server or because a firewall blocked access to the website.
   Unsupported Key Length	Select the action to take when the decryption encounters an unsupported key length: Alert—Allow the decrypt session and generate an entry in the SSL log. Allow—Allow the decrypt session without generating an entry in the SSL log. Drop packet—The browser waits for a response from the server and then drops the packets. It is not possible to determine whether the packet was dropped because of a delayed response from the server or because a firewall blocked access to the website. Drop session—The browser waits for a response from the server and drops the session. It is not possible to determine whether the session was dropped because of a delayed response from the server or because a firewall blocked access to the website. Reject—The browser displays an alert and resets the connection to the server. It is not possible to determine whether this occurred because of a delayed response from the server or because a firewall blocked access to the website.
   Unsupported Version	Select the action to take when the decryption encounters an unsupported CA version: Alert—Allow the decrypt session and generate an entry in the SSL log. Allow—Allow the decrypt session without generating an entry in the SSL log. Drop packet—The browser waits for a response from the server and then drops the packets. It is not possible to determine whether the packet was dropped because of a delayed response from the server or because a firewall blocked access to the website. Drop session—The browser waits for a response from the server and drops the session. It is not possible to determine whether the session was dropped because of a delayed response from the server or because a firewall blocked access to the website. Reject—The browser displays an alert and resets the connection to the server. It is not possible to determine whether this occurred because of a delayed response from the server or because a firewall blocked access to the website.
   Minimum Supported Key Length	Enter the minimum RSA key length, in bits. Range: 512 through 65535 Default: 512
   TLS Protocol	Select the TLS protocol: Minimum Version—Select the minimum version of TLS protocol that is supported. The minimum version must be the same as or earlier than the maximum version. TLS 1.1 TLS 1.2 TLS 1.3 Maximum Version—Select the maximum version of TLS protocol that is supported. The maximum version must be the same as or later than the minimum version. The options displayed depend on the version you select in the Minimum Version field. For example, if the minimum version is TLS 1.1, the options TLS 1.1, TLS 1.2, and TLS 1.3 are displayed. If the minimum version is TLS 1.2, the options TLS 1.2 and TLS 1.3 are displayed.
   Key Exchange Algorithms	When you select minimum and maximum TLS versions and the version is not TLS 1.3, select one or more key exchange algorithms for the SSL connection: ECDHE—Elliptic-curve Diffie–Hellman Key Exchange RSA—Rivest–Shamir–Adleman algorithm
   Encryption Algorithms	Select an encryption algorithm to use: AES-128-CBC—AES CBC encryption algorithm with 128-bit key AES-128-GCM—AES GCM encryption algorithm with 128-bit key AES-256-CBC—AES CBC encryption algorithm with 256-bit key AES-256-GCM—AES GCM encryption algorithm with 256-bit key Camellia-256-CBC—Camellia encryption algorithm with 256-bit key Chacha20-Poly1305—ChaCha stream cipher and Poly1305 authenticator Seed CBC—TLS RSA with seed CBC
   Authentication Algorithms	Click to have the selected LEF profile be the default LEF profile: SHA—Secure Hash Algorithm SHA-256—Secure Hash Algorithm 2 with 256-bit digest SHA-384—Secure Hash Algorithm 2 with 384-bit digest
   Cipher Suites	Select a TLS cipher suite. If you select a cipher suite, it must be consistent with the selected key exchange, encryption, and authentication algorithms. If you do not configure cipher suites, all cipher suites matching the selected the key exchange, encryption, and authentication algorithms are selected by default. TLS-AES-128-GCM-SHA256 TLS-AES-256-GCM-SHA384 TLS-CHACHA20-POLY1305-SHA256 TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256 TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384 TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256 TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256 TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256 TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384 TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256 TLS-RSA-WITH-AES-128-CBC-SHA TLS-RSA-WITH-AES-128-CBC-SHA256 TLS-RSA-WITH-AES-128-GCM-SHA256 TLS-RSA-WITH-AES-256-CBC-SHA TLS-RSA-WITH-AES-256-CBC-SHA256 TLS-RSA-WITH-AES-256-GCM-SHA384 TLS-RSA-WITH-CAMELLIA-256-CBC-SHA TLS-RSA-WITH-SEED-CBC-SHA
   Logging (Group of Fields)
   None	Click to perform no logging.
   Default	Click to use default logging.
   Custom	Click to configure logging to a customer log server. Based on the rule match, the device may send many log messages.
   Please Select	If you select Custom, click the down arrow to select a log profile. To create a new custom flow logs profile, click . For more information, see Add Custom Logs Profile.

6. Click Add.

Configure TLS Decryption Rule

In a TLS ecryption rule, you define the traffic of interest, and for matching traffic you define whether to decrypt the traffic, inspect the traffic, or both decrypt and inspect it. Create a TLS decryption rule without source and destination zones, or only configure the destination zone.

To configure TLS decryption rule:

1. Click Configure in the left menu bar to open the Configure dashboard.
2. Hover over the device in the honeycomb and click Configure to open the site information window.
3. Click the Security tab, and then click Decryption.
   
   
    
4. Click the icon in the TLS Decryption section to create a rule for decryption.
   
   
   
   
   Each rule displays a numbered circle indicating its position in the rule set. Circle color indicates whether a rule decrypt (red) or decrypt bypass (green) traffic. By default, the rules are displayed in grid view. To change the view to list, click the list view icon. To pin the view to grid or list for the login session, use the pin icon.
5. If needed, click Reorder Rules to enter rule reorder mode.
   1. To change a rule order, click the colored circle and drag the rule to a different spot in the rule set. The rule numbers are updated automatically.
   2. Click Publish Reordered Rules to save the changes to the Titan cloud.
6. In the Decryption Add window, enter information for the following fields.
   
   
    

   Field	Description
   Rule Name (Required)	Enter a name for the decryption rule. Slide the toggle to enable or disable rules.
   Description	Enter a text description for the rule. It can be a maximum of 63 characters.
   Match Criteria	Click Protocol, Address, Hostname, URL, or User and Group to add details for that criteria type. For more information, see Apply Match Criteria for TLS Decryption Rules, below.
   Scope (Group of Fields)	Select the traffic source and destination.
   Source	Click the down arrow in the Please Select list. Select the source network security zone to which to apply the decryption policy rule to traffic coming from any interface in the zone, and then click Continue.   SD-WAN—Select for the traffic coming to the gateway over overlay tunnels from remote SD-WAN branches. Untrust (Internet)—Select for internet-facing WAN interfaces. Wired LAN—Select for LAN interfaces that are controlled by enterprises. Wireless LAN—Select for LAN interfaces that are on wireless networks.
   Arrow	Choose a one-way or two-way connection.
   Destination	Click the down arrow in the Please Select list. Select the destination network security zone to which to apply the decryption policy rule to traffic coming from any interface into the zone, and then click Continue.   SD-WAN—Select for the traffic coming to the gateway over overlay tunnels from remote SD-WAN branches. Untrust (Internet)—Select for internet facing WAN interfaces. Wired LAN—Select for LAN interfaces that are controlled by enterprises. Wireless LAN—Select for LAN interfaces that are on wireless networks.
   Action	Select the action to take on the traffic: Decrypt—Click to enable decryption. Decrypt Bypass—Click to bypass the decryption of SSL traffic that matches the predefined actions.
   Select Profile	If the action selected is decrypt, select the decryption profile.

7. Click Add.

Apply Match Criteria for TLS Decryption Rules

You can use the following match criteria types in a TLS decryption rule:

• Protocol
• Address
• Hostname
• URL
• User and Group

To specify match criteria for a TLS decryption rule:

1. To specify protocol criteria for a TLS decryption rule:
   1. Select the Protocol tab to display the protocol window.
      
      
       
   2. In the Please Select field, select a protocol. Titan Portal automatically populates the next field with common port numbers.
   3. If needed, click the port number field and edit the port number range.
       
2. To specify address criteria for a TLS decryption rule:
   1. Select the Address tab to display the address window.
      
      
   2. Click the toggle switch to enter the source or destination IP address. Then click Source.
      
      
       
   3. Enter a source IP address in CIDR format, and then click the icon. To remove an IP address from the list, click the icon.
      
      
   4. Click Continue
   5. Enter a destination IP address in CIDR format, and then click the icon. To remove an IP address from the list, click the icon.
      
      
   6. Click Continue
       
3. To specify hostname criteria for a TLS decryption rule:
   1. Select the Hostname tab to display the Hostname window.
      
      
   2. Click the toggle switch to enter the source or destination hostname. Then click Source.
      
      
       
   3. Enter a source hostname, and then click the icon. To remove a hostname from the list, click the icon.
      
      
       
   4. Click Continue
   5. Enter a destination hostname, and then click the icon. To remove a hostname from the list, click the icon.
      
      
   6. Click Continue.
4. To specify URL criteria for a TLS decryption rule:
   1. Select the URL tab to display the URL window.
      
      
   2. Enter the URL pattern, for example, https://google.*. You can save the URL patterns in .txt file format and add multiple .txt files separated by a comma. Click Browse File to add te file.
   3. In the URL Category section, select the URL categories to decrypt. Titan devices support a wide range of predefined URL categories that you can apply in different types of security policies. You can look up URL categories in the database of predefined URL database to determine the URL category. The predefined URL database is updated daily or in real time as part of security package (SPack) updates.
      
      
      • To add custom URL category, click the  icon. For more information, see Add Custom URL Categories.
      • To configure look up URL settings, click the  icon. For more information, see Configure Look Up URL Settings.
   4. Click Add.
   5. In the URL Reputation section, select the URL reputation to decrypt and click Continue.
      
      
      
      Use the Customize option to modify the URL reputation.
5. By default, security enforcement is applied to all users and user groups. To change these settings, select the User and Group tab and do the following.
   
   
   1. Select a user to bind with the security policy: Any, Known, Unknown, or Selected.
   2. To select specific user and group, click Selected and then do the following:
      1. Select an LDAP user group profile from the Select LDAP list.
      2. Use the search box to search for the user and group, or click the check box next to the user and group name.
         
         
   3. Click Add.

Apply Match Criteria for Authentication Rules

You can use the following match criteria types in an authentication rule:

• Address
• Application
• Hostname
• Protocol
• URL

To specify match criteria for an authentication rule:

1. To specify protocol criteria for an authentication rule:
   1. Select the Protocol tab to display the protocol window.
      
      
   2. In the Please Select field, select a protocol. Titan Portal automatically populates the next field with common port numbers.
   3. If needed, click the port number field and edit the port number range.
2. To specify address criteria for an authentication rule:
   1. Select the Address tab to display the address window.
      
      
   2. Click the toggle switch to enter the source or destination IP address. Then click Source.
      
      
   3. Enter a source IP address in CIDR format, and then click the icon. To remove an IP address from the list, click the icon.
      
      
   4. Click Continue
   5. Enter a destination IP address in CIDR format, and then click the icon. To remove an IP address from the list, click the icon.
      
      
   6. Click Continue
3. To specify hostname criteria for an authentication rule:
   1. Select the Hostname tab to display the Hostname window.
      
      
   2. Click the toggle switch to enter the source or destination hostname. Then click Source.
      
      
   3. Enter a source hostname, and then click the icon. To remove a hostname from the list, click the icon.
      
      
   4. Click Continue
   5. Enter a destination hostname, and then click the icon. To remove a hostname from the list, click the icon.
      
      
   6. Click Continue.
4. To specify application and application groups criteria for an authentication rule:
   1. Select the Application tab, and then click Click Here To Add or Modify Applications.
      
      
   2. The Authentication > Rules > Add Application popup window displays. Select the Applications tab is selected by default. Then, select the application to include in the match list, or type the name of the application in the search box and then select it from the search results, and then click Add.
      
      
      • Click + Custom Applications to create a new custom application object. For more information, see Add Custom Applications.
   3. Select the Application Groups tab. Then select predefined application groups to include in the match list, or type the name of the application group in the search box and then select it from the search results, and then click Add.
      
      
5. To specify URL criteria for an authentication rule:
   1. Select the URL tab to display the URL window.
      
      
   2. Enter the URL pattern, for example, https://google.*. You can save the URL patterns in .txt file format and add multiple .txt files separated by a comma. Click Browse File to add te file.
   3. In the URL Category section, select the URL categories to decrypt. Titan devices support a wide range of predefined URL categories that you can apply in different types of security policies. You can look up URL categories in the database of predefined URL database to determine the URL category. The predefined URL database is updated daily or in real time as part of security package (SPack) updates.
      
      
      • To add custom URL category, click the  icon. For more information, see Add Custom URL Categories.
      • To configure look up URL settings, click the  icon. For more information, see Configure Look Up URL Settings.
   4. Click Add.
   5. In the URL Reputation section, select the URL reputation to decrypt and click Continue.
      
      
      Use the Customize option to modify the URL reputation.
6. Click Add.

Example: Configure a SAML Authentication Rule

Before you create a SAML authentication rule, you must configure a SAML profile, which contains information about the third-party SAML IdPs and other protocol information. Then, you associate the SAML profile with the SAML authentication rule.

To create a SAML authentication rule, you perform the following tasks:

1. Create three authentication rules in the following order:
   1. Create an authentication rule to allow DNS packets.
   2. Create an authentication rule to allow IdP packets.
   3. Create a SAML authentication rule.
2. Create a firewall rule without source and destination zones and destination port must be 44991 and 8080.
3. Create a TLS decryption rule without source and destination zones.

To create a SAML authentication rule:

1. Click Configure in the left menu bar to open the Configure dashboard.
2. Hover over the device in the honeycomb and click Configure to open the site information window.
3. Click the Security tab, and then click Authentication.
   
   
    
4. Click the icon in the Authentication section to create a rule for authentication.
   
   
   
   Each rule displays a numbered circle indicating its position in the rule set. Circle color indicates whether a rule do not authenticate (red) or authenticate using a profile (green). By default, the rules are displayed in grid view. To change the view to list, click the list view icon. To pin the view to grid or list for the login session, use the pin icon.
5. If needed, click Reorder Rules to enter rule reorder mode.
   1. To change a rule order, click the colored circle and drag the rule to a different spot in the rule set. The rule numbers are updated automatically.
   2. Click Publish Reordered Rules to save the changes to the Titan cloud.
6. In the Authentication Add window, create an authentication rule to allow DNS packets by entering the following information.
   
   
    
   1. Enter a firewall rule name.
   2. Enter the description for the rule.
   3. In the Protocol tab, select UDP, and enter 53 as the port number.
   4. In the Action section, click Do Not Authenticate.
7. Click Add.
8. Click the icon in the Authentication section to create a rule for authentication.
9. In the Authentication Add window, create an authentication rule to allow IdP packets by entering the following information.
   
   
   1. Enter an OKTA IdP rule name.
   2. Enter the description for the rule.
   3. Click URL tab, enter a URL pattern, an then click the Add icon.
   4. In the Action section, click Do Not Authenticate.
10. Click Add. The OKTA IdP rule is added to the rules list.
11. Click the icon in the Authentication section to create a rule for SAML authentication.
12. In the Authentication Add window, create a SAML rule by entering the following information.
    
    
     
    1. Enter a SAML authentication rule name.
    2. Enter a rule description.
    3. Select source and destination zones.
    4. In the Actions section, click Authenticate Using Profile to authenticate using an authentication profile. Enter information for the following fields.
       • Cache Expiration—Enter the time, in minutes, after which cache for the authentication profile expires.
         Default: 10 minutes
       • Concurrent Login—Enter the number of concurrent logins a user can perform from different devices.
       • Expiration Mode—Select the mode to use to end a session:
         • Fixed Interval—Use the time specified in the cache expiration as the time interval to end a session.
         • Inactivity—Use the time specified in the cache expiration as the interval of inactivity after which to end a session.
       • In the Authenticator section, click SAML Profile, and in the Select Authentication Profile list, select a SAML profile to associate with this authentication profile. Click + Authenticator Profile to add a new SAML profile. For more information, see Configure SAML Profiles.
13. Click Add.
    
    
     
14. In the Security tab, click Security Policy.
15. In the Firewall Policies section, click Firewall Rules and then click +Rule to create a firewall rule. Enter the following information.
    
    
    1. Enter a firewall rule name.
    2. Enter a rule description.
    3. In the Protocol tab, select TCP, and enter 44991 and 8080 as the port numbers.
16. Click Add.
17. In the Security tab, click Decryption.
18. In the TLS Decryption section, click +Rule to create a decryption rule. Enter the following information.
    
    
     
    1. Enter a decryption rule name.
    2. Enter a rule description.
    3. In the Protocol tab, select TCP, and enter 443 as the port number.
    4. Select a decryption profile.
19. Click Add.