topic Re: SSL Policy Not Applied to Wikipedia Domain in Cisco Firepower 6.3 in Network Security

SSL Policy Not Applied to Wikipedia Domain in Cisco Firepower 6.3 (EVE

elkabeermg — Sat, 19 Apr 2025 07:45:00 GMT

I’m currently testing Cisco Firepower Threat Defense (FTD) version 6.3 deployed in EVE-NG, and it’s managed by Firepower Management Center (FMC) version 6.7.

I’ve configured an SSL decryption policy to perform SSL inspection on all outbound HTTPS traffic. The policy is working as expected for most domains (e.g., Google, YouTube, etc.), but I’ve noticed that SSL inspection is not applied to wikipedia.org and its subdomains, even though:

There are no exclusions or bypass rules configured in the SSL policy.
The domain is not listed in any trusted CA override or rule.
No rule explicitly matches or excludes Wikipedia.
The client browser shows a direct connection using the real Wikipedia certificate, not the re-signed one from the FTD device.

I’ve double-checked the access control policy, SSL rules, and certificates, and everything seems fine. I’m wondering if this could be related to:

A default system-level bypass in FTD for specific websites?
Some behavioral limitation when running FTD in EVE-NG?

Has anyone experienced similar behavior with Wikipedia or other major domains not being inspected? Any ideas or suggestions for troubleshooting this would be greatly appreciated.

Re: SSL Policy Not Applied to Wikipedia Domain in Cisco Firepower 6.3

MHM Cisco World — Sun, 20 Apr 2025 11:47:59 GMT

I dont known but are FTD in eve-ng have a ssl license.

This need to make ftd encrypt ssl traffic.

MHM

Re: SSL Policy Not Applied to Wikipedia Domain in Cisco Firepower 6.3

elkabeermg — Mon, 21 Apr 2025 12:58:32 GMT

Yes some other domains like google and youtube are already inspected i can find logs of ssl decryption in connection events for these domain in addition to they have local CA that i configure in FTD

Re: SSL Policy Not Applied to Wikipedia Domain in Cisco Firepower 6.3

Marvin Rhoads — Mon, 21 Apr 2025 15:27:46 GMT

Did you verify the Wikipedia https traffic is tcp/443 (SSL/TLS) and not udp/443 (QUIC)?

Re: SSL Policy Not Applied to Wikipedia Domain in Cisco Firepower 6.3

elkabeermg — Mon, 21 Apr 2025 15:54:29 GMT

I already make a acp rule that block udp 443 above main rule