SSL Block Page work around

[kenny.cacka]

I know that sourcefire can't natively throw up a block page on SSL encrypted pages, but does anyone know of a work around?

[Philip D'Ath]

Are you saying you want to block all https traffic?  If so just tell the ASA to do this.

[ankojha]

Hi,

If you are running the latest version 6.0, since the ssl decryption feature is added , you 

can enable it and set the action to interactive block for your requirement.

Rate if it helps.

Thanks,

Ankita

[Philip D'Ath]

The only catch with using this feature is you have to be able to put a trusted CA certificate on every machine and device that sits behind SourceFire to make it work.  This can be quite prohibitive sometimes.

[kenny.cacka]

yes, but I am really just talking about the Block Response page.  It doesn't happen if the traffic is HTTPS.

[ankojha]

Hi Kenny,

Could you check under access control policy -> HTTP response tab 

if response message is set to none /system provided ?

Thanks,

Ankita

[kenny.cacka]

yes, http works fine and shows a proper block page.  Just when going to https sites does the block page not show.  It is my understanding that this is normal behavior, I am just looking for a work around.

[ankojha]

Hi Kenny,

The workaround would be to use ssl inspection policy so that this traffic can be decrypted and you can get the custom block page. This feature is available in version 6.0.

Thanks,

Ankita

[Thomas Winther]

Hi

Did anyone succeed in showing a response page for ssl, when enabling inspection?

Please say yes :-)

//Thomas

[kenny.cacka]

nope, I was told that I would need a SSL appliance in front of the ASA so the info was decrypted before it got to me.  Also, SSL decryption on the ASA takes a 80% hit right off the bat so it's not even worth turning on.

[kenny.cacka]

Sorry guys, I should have been more clear.  I know that you can block SSL pages, however when it gets blocked, it does not put up a response page saying something like "This page is unauthorized, please contact your administrator."  Which, as you know, you get a page like that when it is just regular http traffic.  I hope this makes sense.