10-06-2014 10:24 PM - edited 03-11-2019 09:52 PM
hi everyone
is Firepower support ssl decryption or should have sourcefire beside ASA?
thanks
Solved! Go to Solution.
08-01-2015 05:04 PM
hi marvin,
thanks for this info! +5
i guess the cisco engineer i worked with was right.
anyways, it's just a POC and i'm just getting output data to present to management.
i'll do firepower probably next month. i hope you guys would be around if i post any questions.
08-01-2015 10:02 AM
08-02-2015 02:42 AM
Asad,
For inspection of incoming https traffic, it's a different story. Assuming you own the server and its certificate, you can put a copy on your inspection engine (WSA or FirePOWER appliance).
In that use case, it has the legitimate certificate of the target server and can, for the purposes of terminating SSL session to inspect the content, act as if it is the server itself.
This is not unlike what we do with Application Delivery controllers (aka load balancers such as Citrix Netscaler or F5 BigIP) when they front for an SSL server farm. In those cases we often pass the traffic to the real servers unencrypted (this is desirable as the modern ADCs have purpose-built hardware and optimized software for SSL offload thus allowing the backend servers to devote more resources to application server tasks vs. encryption/decryption); but they all have the option of re-encrypting as well.
(EDIT - note this feature is for IPS only, e.g. FirePOWER appliances.)
08-02-2015 02:42 AM
Thanks Marvin,
That's interesting you mentioned the big-names in load-balancing tech e.g F5 and others, I researched F5 for a few hours and the term they used to describe the concept of "decrypt-inspect-re-encrypt" as ssl-bridging. Now, what I know it requires two profile at least client and server side to ensure complete end-to-end encryption.
In your last post, you mentioned for incoming ssl inspection a copy of server certificate and key would be fine, but it was my mistake I forgot to ask what about the need to re-encrypt once it is done with inspection like does the concept of ssl-briding holds true on WCSA and firepower as well. I remember you said in another post that "YES it does that", but then it makes me confused about use of certificates, for CWSA to act as ssl client to target server it needs a certificate / key as well. Where would that comes from? The certificate from server /key we copied on appliance would do fine to act as "client profile" allowing to act like a server but what about the other half of journey (appliance to target server)
Sorry for confusion
08-02-2015 06:22 AM
Asad,
For the "appliance to target server" use case, you don't need a certificate-key pair on the appliance for that backend communications link. The target server(s) have the necessary pair. Remember for that link, the appliance is the client and no more needs its own certificate than you do when you browse to any "https" URL via SSL/TLS.
Netscaler (which I'm most familiar with) calls this "SSL Offloading with End-to-End Encryption". SSL bridging is something else - not decrypting the SSL at all. As described here, it doesn't require a certificate on the appliance at all.
08-04-2015 01:47 AM
Marvin,
Thanks for giving much needed clarity on the subject. However, I'm stuck on something which I'm not able to locate in CWSA datasheets, this is in regard to how for e.g inbound ssl mode web-attack such sql injection will be handled / absorbed by the appliance , is there an ips engine running inside CWSA which does that?I'm mean where the signatures for such actions comes from. Thanks.
[UPDATE] For e.g in macage ngfw, for inbound ssl inspection, I have the ability through defining a "policy" which features set to apply from ips signatures, anti-malware etc. Does the same concept applies in case of cwsa?
08-04-2015 06:01 AM
Asad,
Sorry but I believe I misspoke earlier in saying that we could inspect the content for incoming SSL with the WSA. That is a feature specific to the IPS appliances.
My apologies for that. I noted the error in my post.
08-04-2015 06:08 AM
08-04-2015 08:59 AM
I'm referring to the Cisco FIrePOWER Next Generation IPS (NGIPS) appliances specifically. That would include the 3D7000, 3D8000 and AMP series of hardware.
It would not be supported (currently - as of 5.4 software) on any of the ASA FirePOWER modules, including the hardware module on the 5585-X. It is also not supported on the virtual FirePOWER appliance.
I believe it is supported on the ASA CX IPS; although that is also end of sales.
It is not supported on any of the legacy Cisco IPS appliances.
08-05-2015 01:24 PM
You've mentioned the the FirePOWER (software) may implement SSL inspection capabilities once version 6 is out.
Is there a timeline for date of release of version 6? If I would be able to perform SSL decryption with an ASA 5506-X in the near future, I would consider purchasing it for my home lab rather than a Palo Alto PA-200.
08-05-2015 01:36 PM
Cisco doesn't typically announce release date until they are actually shipping the code.
The best projection they were sharing publicly at Cisco Live earlier this summer was "Fall 2015". They also caveat that you will take quite a performance hit by doing the SSL decryption in software, especially in the lower end boxes.
08-05-2015 01:48 PM
Thank you for the information.
My home lab is a way for me to practice enterprise architecture and security on a micro-scale. It won't be at my home internet perimeter, but will be used to segregate my home lab network from my home recreation network. There won't be too much lab traffic crossing the firewall unless I'm hairpinning, so I'm not too worried about the performance hit.
The PA-200's also take a significant performance hit when they enable inspection.
11-13-2015 07:15 AM
Marvin,
Have you heard any work yet for SSL decryption on the ASA's yet. I still can't find anything on it.
Austin
11-13-2015 07:24 AM
Austin,
We still expect it in 6.0 on the ASA FirePOWER modules. It should be out in the next month or two.
11-13-2015 09:46 AM
6.0 FirePOWER code was released and is already posted on CCW. Here are the release notes that indicate support for SSL decryption.
Thank you for rating helpful posts!
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide