topic Enable SSL Decryption on the Cisco ASDM in Network Security

Enable SSL Decryption on the Cisco ASDM

deenhisham — Fri, 21 Feb 2020 16:55:47 GMT

Hello,

So i am new to firewalls and i have got this question from one of our users

"We have had issues with our proxy service and they have asked us to check the below.

Which firewall you are using upstream? Could you confirm if you have enabled SSL decryption on Firewall as well? "

Not sure if the ASAv supports SSL Decryption.

Re: Enable SSL Decryption on the Cisco ASDM

Dennis Mink — Mon, 11 Mar 2019 10:47:04 GMT

Most likely the answer is no. So in what direction is this traffic going through the fw? Outbound to internet? So if you are simply permitting https through your fw from the proxies IP; then you are not decrypting.

Re: Enable SSL Decryption on the Cisco ASDM

Marvin Rhoads — Mon, 11 Mar 2019 15:11:48 GMT

ASAv does not support SSL decryption at all since it doesn't support the Firepower service module.

Other models of ASA 5500-X support it in software if there is a Firepower service module in place with an SSL policy that's been all setup. They also support it if they are running FTD image, as do Firepower appliances running FTD.

We seldom see it used on ASAs in production for general purpose traffic inspection since the performance is pretty slow and it can quickly bring a smaller appliance to its knees. It also requires intermediate to advanced knowledge of PKI to make it work properly - something that is not all that common.