Hi All,
I have a customer deploying ASAs with Firepower 6.2. We are performing SSL decrypt features and if you’ve worked with these technologies and encryption you will know that sometimes a website must be bypassed, for a variety of reasons. With Firepower you may not use a customer URL in the SSL decryption policy for bypass. Meaning if you are having issues with a website because of SSL decrypt you cannot isolate that URL via DNS name resolution. The only way I know to resolve this issue is via IP address or trusting bulk categories (assuming you have a URL license). This makes the solution almost unworkable in most situations. We all know website IPs don’t stay static in many circumstances. The Cisco solution is very poor for the use of SSL decrypt in a production network. Support is not very good on this product for issues outside of basic configurations either which is too bad because it’s a good product.
