topic Re: SSL decryption exception fail in Network Security

SSL decryption exception fail

Otvforte — Thu, 04 Sep 2025 17:41:35 GMT

I'm working on creating an SSL decryption policy, but I'm running into an issue where the "no decryption" rule is failing to prevent decryption.

Interestingly, if I configure the "no decryption" rule using a subnet address, it works as expected. However, when I use a URL in the rule, it doesn't seem to have any effect.

Am I missing something here? These same rules used to work fine in version 7.4.2, but they no longer work in 7.6.2.

Any insights would be appreciated.

Regards

Re: SSL decryption exception fail

MHM Cisco World — Thu, 04 Sep 2025 18:39:34 GMT

The key here I think is tls 1.2 vs tls 1.3

MHM

Re: SSL decryption exception fail

Otvforte — Thu, 04 Sep 2025 18:51:27 GMT

I would agree that it could be a problem, firewall not being able to look at the certificate and match URL, but it was working prior to upgrade to 7.6.2, so maybe is anoter sort of problem. I'll reset the firewall and try again with the previous version.

Re: SSL decryption exception fail

MHM Cisco World — Thu, 04 Sep 2025 18:55:58 GMT

There is option to select tls 1.3 in ssl policy and tls 1.3 decryption

Before downgrade check these options

Also you can capture traffic in ftd interface and check tls ver use

MHM