Encrypted traffic inspected by IPS ?

[ankurs2008]

Dear All

We are having following scenario at one of the customers

ISP Link -> L2 Switch -> IPS in Inline (VLAN)Mode -> PIX Firewall

There are lot of Site to Site VPN tunnels terminated on the PIX Firewall; hence please let me know if the VPN traffic towards firewall will be inspected by IPS and if yes how will the signature analysis happen for it i.e whether IPS will really be able to undertstand the encrypted traffic ?

Regards

Ankur

[scothrel]

Ankur,

The IPS will inspect the encrypted traffic but does not have the ability to look inside the encryption; it generally cannot understand the encrypted traffic; so all the inspection can do is IP Header type inspections like sweeps, floods, and "impossible IP packet" type checks. It may also do L4 inspections depending on your VPN technology...but the encrypted data is still opaque (cannot be understood). Any clear (non-vpn) traffic is still inspected; the meer presence of VPN does not affect non-VPN inspection.

To inspect the data that is traversing the VPN's, you'd need to put an IPS inline behind the PIX (post VPN termination).

Scott