Example 4: using router objects in the SSL proxy

This example shows how a router object is used to provide failover in the SSL proxy: the first two links, WAN-1 and WAN-2, are set as the main gateways, with WAN-3 set as a failover gateway.

Do note that a router object can also be used with load balancing between its gateways.

For more information on filtering SSL traffic, refer to the technical note Filtering HTTPS connections.

Routing principle

The SSL proxy may use:

  • A default route through a router object that provides failover,
  • Policy-based routing.

When a gateway in the router object becomes unreachable, an RST packet is sent to the client's web browser, which establishes a new connection via the SSL proxy over one of the available WAN links.

Creating the router object that will be used for routing

  1. Go to Configuration > Objects > Network.
  2. Click on Add.
  3. In the column on the left side of the object creation window, select Rrouter.

General properties

  1. Name the object (e.g., ROUTER-LILLE-WAN-FAILOVER).

Monitoring

  1. For the Detection method, select ICMP.
  2. Adjust the Timeout (s) as needed.
  3. Adjust the Interval (s) as needed.
  4. Adjust the number of Failures before degradation (3 by default).

SD-WAN SLA (thresholds)

  1. Select SD-WAN SLA (thresholds).
  2. Adjust the Latency (ms) as needed.
  3. Adjust the Jitter (ms) as needed.
  4. Adjust the Packet loss rate (%) as needed.
  5. Do not enter an Unavailability rate (%).

Gateways

  1. In the Gateways used tab, click on Add.
  2. In the Gateway column, select the object LIL-WAN-1.
  3. In the Device(s) for testing availability column, select Test the gateway directly.
  4. In the Backup gateways tab, click on Add.
  5. In the Gateway column, select the object LIL-WAN-2.
  6. Repeat steps 17 and 18 to add the object LIL-WAN-3.
  7. In the Device(s) for testing availability column, select Test the gateway directly.

Advanced properties

  1. In Advanced properties, select No load balancing for the Load balancing field.
  2. For Enable backup gateways, select When all gateways cannot be reached.
  3. Click on Apply then Save.

Default routing

Adding the router object as the default route

  1. Go to Configuration > Network > Routing.
  2. In the Default gateway field, select the router object that was created earlier (ROUTER-LILLE-WAN-FAILOVER in this example).
  3. Click on Apply then Save.

Creating an SSL inspection rule

  1. Go to Configuration > Security policy > Filter - NAT, Filtering tab.
  2. Click on New rule > SSL inspection rule.
  3. In the Source hosts field: leave the default object Network_internals, or select an object corresponding to your client hosts.
  4. In the Dest port field: select the https object.
  5. If you have not set any specific Inspection profile or SSL filter policy, you can leave the other default values as they are. Otherwise, select your inspection profile and/or SSL filter policy.
  6. Click on Finish.
  7. Click on Apply to confirm these changes to the filter policy.
  8. Click on Activate now if you wish to enable this policy immediately, or Later.

The SSL inspection rule will then look like this:

Policy-based routing

Creating an SSL inspection rule

  1. Go to Configuration > Security policy > Filter - NAT, Filtering tab.
  2. Click on New rule > SSL inspection rule.
  3. In the Source hosts field: leave the default object Network_internals, or select an object corresponding to your client hosts.
  4. In the Dest port field: select the https object.
  5. If you have not set any specific Inspection profile or SSL filter policy, you can leave the other default values as they are. Otherwise, select your inspection profile and/or SSL filter policy.
  6. Click on Finish.
  7. Double-click in the Action column of the newly created decryption rule.
  8. In the General tab, for the Gateway - router field, select the router object that will be used for routing (ROUTER-LILLE-WAN-FAILOVER in this example).
  9. Click on OK, then Apply to confirm these changes to the filter policy.
  10. Click on Activate now if you wish to enable this policy immediately, or Later.

The SSL inspection rule will then look like this: