topic Re: AMP SSL decryption in Network Security

AMP SSL decryption

ashleybabajee — Thu, 04 Jul 2019 05:02:10 GMT

Hi,

I have AMP for network on Firepower 2130, have configured file policy etc and have been using this site to test

https://www.eicar.org/?page_id=3950.

Http request are blocked by AMP, however https are not, we then configured ssl decryption, import certificate etc however it still doesnt work.

Any help or guide would be much appreciated.

Thanks

Re: AMP SSL decryption

Marvin Rhoads — Thu, 04 Jul 2019 14:42:06 GMT

Have you confirmed your SSL decryption policy is working for the target page?

That said, decrypting SSL/TLS en masse to protect against malware is generally a dead end exercise. It's much more effective to protect on the endpoints using something like Cisco AMP for Endpoints.

Re: AMP SSL decryption

ashleybabajee — Fri, 05 Jul 2019 04:27:49 GMT

Hi @Marvin Rhoads

Yes, decryption works, i do get the page loaded with the certificate ,when i do http download it block the files, however for https it doesnt.

We already got AMP for network, so i guess we have to make it work and maybe later migrate to Endpoint ones.

Re: AMP SSL decryption

Marvin Rhoads — Sun, 07 Jul 2019 03:40:21 GMT

Hmm SSL decryption definitely takes place prior to File analysis in the order of operations.

Can you share a screenshot of your relevant ACP rule and associated file and SSL policies?

I wonder if you are hitting a bug. What Firepower version are you running by the way?

You may want to open a TAC case on this as it seems you have the right elements in place to make it work.