SSL inspection on Cisco ASA

[Arshad Safrulla]

I would like to see if there is any document which has the cons of ssl inspection of firepower module.

Like the effect on resource usage like memory, processing power on the firewall

[Sheraz.Salim]

we have 5555-X series with firepower SFR we were very intersted to do the SSL decryption but later the recommendation came from cisco if you looking for SSL decryption that use WSA or FTD bigger box.

so long story short if its production network stay out of it, if in the lab purpose yes go and try it. 

  here is a link

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-firepower-services/200577-Configure-the-SSL-decryption-on-FirePOWE.pdf

https://routemypacket.blogspot.com/2017/11/ssl-decryption-with-cisco-firepower.html

https://www.a10networks.com/resources/articles/ssl-inspection-decryption-cisco-asa-firepower

[Arshad Safrulla]

Thank you. But I am looking for a cisco documentation which at least says that it is a resource intensive task.

[Sheraz.Salim]

I never came across where Cisco said it’s a resource incentive. 

But runnning in lab environment personally and after even Cisco TAC recommendation is not run ssl decrying on ASA with sfr as it’s spikes the cpu. 

This is from the experience even though if you want to try and don’t believe than what else can be say.

ssl decrying work good with FTD 9300 for sure

[Arshad Safrulla]

Thank You once again. I am looking at a 5525-X box with AMP, IPS enabled and on top of this will be doing SSL decryption.
There are around 400 users behind the network with around 15 IPSEC tunnels terminated in the box.
I want a reason to convince my management not to do SSL inspection on the same box.

[Sheraz.Salim]

Check this link in regards to throughout with IPS and NGIPS

https://www.cisco.com/c/dam/global/th_th/assets/docs/seminar/ASA5500_X.pdf

[Dennis Mink]

I is common knowledge/best practise to do SSL encryption/decryption on a separate box in your DMZ, back in the day, it was called "SSL offloading". all customers i support run this on a F5 Big IP (or radware box)