azure firewall idps protocol and encryption

Yang, Steven 151

Hello,

out of all the idps signatures, is there a way for us to tell which one requires ssl decryption to be enabled? meaning the signature won't be able to properly inspect the traffic if it is encrypted.

Best,

Steven

Yang, Steven 151 Reputation points

2023-09-19T14:40:07.4866667+00:00

also - i noticed that some signature rules would get deleted. how does that work and how can I get notify about it?
GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-09-20T08:48:19.6+00:00

Hello @Yang, Steven ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I'll discuss your query with the Azure Firewall Product Group team and keep you posted on the updates.

Regards,

Gita
GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-09-20T15:55:15.8533333+00:00

@Yang, Steven , could you please elaborate on this statement "I noticed that some signature rules would get deleted"? Are the rules auto deleted?
Yang, Steven 151 Reputation points

2023-09-20T15:58:13.39+00:00

last week the signature rule count was 62K something, this week the count dropped to 61K something.
GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-09-20T17:13:02.4533333+00:00

@Yang, Steven , thank you for the quick update. I'll check on this and get back to you soon.
GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-09-20T19:51:08.9866667+00:00

Hello @Yang, Steven ,

I discussed the above queries with the Azure Firewall Product Group team, and below are the responses:

Out of all the IDPS signatures, is there a way for us to tell which one requires SSL decryption to be enabled? Meaning the signature won't be able to properly inspect the traffic if it is encrypted.

Majority of the signatures requires TLSi to take effect, the signatures that are applicable for encrypted traffic relate to L3 and L4 protocols, they are basically related to the connection establishment part until the encrypted tunnel is constructed.

I noticed that some signature rules would get deleted. Last week the signature rule count was 62K something, this week the count dropped to 61K something. How does that work and how can I get notified about it?

Signatures rules that are not seen in use for long period (years) are being cleaned out.

Kindly let me know if you've any follow-up questions.

Regards,

Gita
Yang, Steven 151 Reputation points

2023-09-20T20:15:49.47+00:00

can you provide a bit more descriptive insight on the TLSi? i need some sort of report that goes up to my leadership to explain what we might missed because we don't have ssl inspection enabled.

for example, can you point out which one of these protocol signatures would most likely required TLSi to be effective?
GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-09-25T12:13:30.44+00:00

@Yang, Steven , I've shared this follow-up question with the Azure Firewall Product Group, and they are checking on this. Will provide an update as soon as I hear from them.
GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-10-04T15:43:41.5066667+00:00

@Yang, Steven , Apologies for the delay!

The team is still looking into this, and I will keep you posted on future updates. Appreciate your patience and understanding on this!
GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-10-12T16:34:32.4966667+00:00

Hello @Yang, Steven , I've added the complete answer below along with the list of TLS agnostic signature IDs which will be effective for HTTPS traffic even if TLSi is disabled.

Kindly let us know if the below helps or you need further assistance on this issue.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-10-13T16:03:16.3466667+00:00

@Yang, Steven , Just checking in to see if you had a chance to see the below answer. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.

And, if you have any further questions do let us know.
GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-10-16T16:57:15.14+00:00

@Yang, Steven , Just checking in to see if you had a chance to see the below answer. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.

And, if you have any further questions do let us know.

1 answer

GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-10-12T16:32:27.4933333+00:00

Hello @Yang, Steven ,

I understand that you wanted to know if there is a way to tell out of all the Azure Firewall IDPS signatures, which one requires SSL decryption to be enabled meaning the signature won't be able to properly inspect the traffic if it is encrypted. You also mentioned that you noticed some signature rules are getting auto deleted and wanted to know the reason behind it.

I discussed the above queries with the Azure Firewall Product Group team, and below are the responses:

Out of all the IDPS signatures, is there a way for us to tell which one requires SSL decryption to be enabled? Meaning the signature won't be able to properly inspect the traffic if it is encrypted.

Majority of the signatures requires TLSi to take effect, the signatures that are applicable for encrypted traffic relate to L3 and L4 protocols, they are basically related to the connection establishment part until the encrypted tunnel is constructed.

Please find attached the list of 1693 TLS agnostic signature IDs --> these signatures will be effective for HTTPS traffic even if TLSi is disabled.

Azure Firewall IDPS TLS Agnostic Signature IDs.pdf

And all the rest of IDPS signatures (which are not in the above list) requires TLS inspection to be enabled if the traffic is TLS encrypted.

I noticed that some signature rules would get deleted. Last week the signature rule count was 62K something, this week the count dropped to 61K something. How does that work and how can I get notified about it?

Signatures rules that are not seen in use for long period (years) are being cleaned out.

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

azure firewall idps protocol and encryption

1 answer

Your answer