Cisco FTD & IPS SSL Decryption

Devlin Thornicroft — Sun, 10 Mar 2019 13:53:28 GMT

Hi all

Hoping someone can help shed some light on this, which to be fair may be even more fundamental and not necessarily FTD-related.

We're still a long way off purchasing a Cisco FTD (4110) but are looking at all the capabilities it has to offer. We have a requirement to provide IPS where the traffic flowing through the box will be encrypted. Am I right in thinking that in order to successfully decrypt the traffic we will need to import onto the FTD the target server's certificate + private key to allow the FTD to effectively as act man-in-the-middle?

Any other considerations we need to take into account, specifically for this platform, that may cause us issues as it relates to IPS and encrypted traffic?

Thank you.

That is one way to decrypt -

Marvin Rhoads — Tue, 25 Jul 2017 15:21:30 GMT

That is one way to decrypt - typically used for incoming traffic where you own the SSL certificate in question.

For outbound traffic it's more problematic since you have to have a PKI and a trusted sub-CA type certificate to the FTD device that is both trusted by all of your clients and able to decrypt Internet-bound traffic. Also some sites and applications will not work with this as they use certificate pinning.

In either case, SSL decryption causes a significant performance hit - about 75-80% - as the current platforms do not decrypt in hardware.

topic That is one way to decrypt - in Network Security

Cisco FTD & IPS SSL Decryption

That is one way to decrypt -