topic Re: SSL inspection on Cisco ASA in Network Security

SSL inspection on Cisco ASA

Arshad Safrulla — Tue, 12 Mar 2019 14:15:01 GMT

I would like to see if there is any document which has the cons of ssl inspection of firepower module.

Like the effect on resource usage like memory, processing power on the firewall

Re: SSL inspection on Cisco ASA

Sheraz.Salim — Thu, 24 Jan 2019 13:33:40 GMT

we have 5555-X series with firepower SFR we were very intersted to do the SSL decryption but later the recommendation came from cisco if you looking for SSL decryption that use WSA or FTD bigger box.

so long story short if its production network stay out of it, if in the lab purpose yes go and try it.

here is a link

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-firepower-services/200577-Configure-the-SSL-decryption-on-FirePOWE.pdf

https://routemypacket.blogspot.com/2017/11/ssl-decryption-with-cisco-firepower.html

https://www.a10networks.com/resources/articles/ssl-inspection-decryption-cisco-asa-firepower

Re: SSL inspection on Cisco ASA

Arshad Safrulla — Thu, 24 Jan 2019 16:09:41 GMT

Thank you. But I am looking for a cisco documentation which at least says that it is a resource intensive task.

Re: SSL inspection on Cisco ASA

Sheraz.Salim — Thu, 24 Jan 2019 16:22:42 GMT

I never came across where Cisco said it’s a resource incentive.

But runnning in lab environment personally and after even Cisco TAC recommendation is not run ssl decrying on ASA with sfr as it’s spikes the cpu.

This is from the experience even though if you want to try and don’t believe than what else can be say.

ssl decrying work good with FTD 9300 for sure

Re: SSL inspection on Cisco ASA

Arshad Safrulla — Thu, 24 Jan 2019 16:26:57 GMT

Thank You once again. I am looking at a 5525-X box with AMP, IPS enabled and on top of this will be doing SSL decryption.
There are around 400 users behind the network with around 15 IPSEC tunnels terminated in the box.
I want a reason to convince my management not to do SSL inspection on the same box.

Re: SSL inspection on Cisco ASA

Sheraz.Salim — Thu, 24 Jan 2019 16:31:54 GMT

Check this link in regards to throughout with IPS and NGIPS

https://www.cisco.com/c/dam/global/th_th/assets/docs/seminar/ASA5500_X.pdf

Re: SSL inspection on Cisco ASA

Dennis Mink — Thu, 24 Jan 2019 21:08:39 GMT

I is common knowledge/best practise to do SSL encryption/decryption on a separate box in your DMZ, back in the day, it was called "SSL offloading". all customers i support run this on a F5 Big IP (or radware box)