HTTPS website

Hi Memorycard 

To generate CSR - Please refer to the article - https://community.sophos.com/kb/en-us/130669

Hi Memorycard 

Yes for virtual host suggestion is to do everything on server ( in place of firewall) and once VH is created on Cyberoam do not enable HTTP/s scanning on WAN to respected zone rule for that particular VH. So end user which is browsing website will get your server certificate ( not the firewall one).

Hello Vishal_R ,

Thanks for replying. 

Could you please describe the operation of AV scanning including HTTP/HTTPS scanning ? I thought this feature will scan HTTP and HTTPS , IM Scanning and ... packets for treats and malware. Which features do you suggest to be activated on Virtual Host rules? (Imaging we want to publish web services, RDP and .... ). 

Dear Keyur , 

I know how to generate CSR and Import certificates. The question is: When we must generate CSR and install certificates on firewalls?

Hi Memorycard 

All Cyberoam appliances are shipped with a unique SSL CA Certificate which is used in HTTPS Deep Scan Inspection. This article describes how you can download Cyberoam's SSL CA Certificate and install it in your local browser and machine.

https://community.sophos.com/kb/en-us/130801

In public key infrastructure (PKI) systems, a Certificate Signing Request (also CSR or certification request) is a message sent from an applicant to a Certificate Authority (CA) in order to apply for a digital identity certificate.

If you are using a third-party CA, Cyberoam allows you to generate a CSR to obtain a signed certificate. The CA verifies the details and issues a signed certificate to the applicant which can then be used for authentication.

https://community.sophos.com/kb/en-us/130669

Hi Memorycard 

Yes you are correct, the scanning option will scan HTTP and HTTPS content for published website. But when you will enable scanning on virtual host, CR firewall use the certificate selected under HTTPS scanning CA and that would be "Cyberoam SSL CA" as a default certificate. 

So external users will get this CA rather then your purchased generated CA but you want your own CA to encrypt and decrypt traffic and this why we suggested you to off HTTP/s scanning of on specific virtual host rule.

You may use your CA as well by importing on firewall  but again that will be getting used by all DNAT rules and other traffic where HTTPS scanning on and traffic passing via firewall.

https://community.sophos.com/kb/en-us/131475

So based on your setup and requirement, the last suggestion is best to achieve your requirement ( to not enable HTTP and HTTPS scanning and import CA on server) and apart from this you may apply IPS on DNAT rule to prevent match or know signature attack to secure your server via IPS policy.

Hello again Vishal_R ,

I got it. Could you please describe the WAF scenario as well ?

Hello Keyur ,

Imagine we're going to publish a HTTPS website:

- In case of using Virtual Host, what is the procedure to not get SSL error on client side? (We are going to use a valid certificate generated by a valid CA like Cetrum)

- In case of using WAF, what is the procedure to not get SSL error on client side? (We are going to use a valid certificate generated by a valid CA like Cetrum)

As Vishal_R described, I need to know the effect of using HTTPS scanning on the above scenarios. 

Hi Memorycard 

As you are aware WAF will help you to prevent Layer 7 attack as well which would be more advantageous in comparison to DNAT.

For WAF hosted on HTTPS you have option to choose specific certificate for that WAF rule as well. So you may upload 3rd party cert on firewall as well to use it for publishing server via WAF on Cyberoam.

Reference snapshot:

More information (Page 33): http://docs.sophos.com/nsg/Cyberoam/Version%2010.x/10.6.3/Guides/Cyberoam%20WAF%20User%20Guide.pdf