topic Re: Firepower SSL decrypt - What ? in Network Security

Firepower SSL decrypt - What ?

Jon Are Endrerud — Wed, 18 Oct 2023 11:50:00 GMT

Hello Everyone

We have a fleet of FTD's and some ASA's that's being phased out.

I have SSL decrypt working and have successfully tried all the functionality and it works as expected. But now I am wondering in networks with several thousand users and devices what is it worth to decrypt with security/maleware in mind ? Im also thinking that one must be carefull regarding CPU usage and so on.

Thanks in advance for any insight on this.

Re: Firepower SSL decrypt - What ?

balaji.bandi — Wed, 18 Oct 2023 12:47:45 GMT

It all depends on security requirement, if you like to go ahead and decrypt the traffic, you have stage level my monitoring the CPU level. (most of the model documentation show you what kind of traffic can handle those boxes) that is part of sizing guide.

you can also choose what site you like to decrypt and souce IP also.

tuning tips :

Re: Firepower SSL decrypt - What ?

MHM Cisco World — Wed, 18 Oct 2023 13:51:45 GMT

The traffic not immediately decrypt and not all traffic decrypt.

The traffic must pass prefilter and acp then white/blacklist before it decrypt.

Re: Firepower SSL decrypt - What ?

Marvin Rhoads — Wed, 28 Feb 2024 12:24:43 GMT

It's rarely possible to decrypt outgoing traffic due to the need to decrypt and re-sign everything which requires having a Certificate Authority that all your user computers trust as a root / signing CA. Plus, even if you have that, may web sites and applications will not allow it due to things like HSTS and certificate pinning. There are better methods to protect your users and traffic.

Incoming traffic to servers you host is generally more amenable to decryption and is a good option since it allows you to see the plain text contents of traffic destined for your servers and more effectively scan for indications of compromise and attacks.