SSL Inspection in ASA

[snarayanaraju]

Hi -  I am curious to understand how the SSL/HTTPS inspection is designed to be handled in Cisco ASA Firewall.

What all I know is that, for SSL inspection the firewall has to de-crypt and again encrypt the traffic passing thru the firewall. Does this require the Server's Private key need to be imported into the firewall for De-cryption and Public key for encrypting?

Thanks in advance

SAIRAM

[Marvin Rhoads]

When we inspect SSL traffic (on the CX module), the ASA acts as a proxy and has an SSL key of its own that is trusted by the user (i.e. issued by a CA in the user's Trusted Certificate store). That allows it to intercept, decrypt, inspect and re-encrypt the traffic.

Here is a link to the User Guide section explaining in more detail.