Confirmation on HTTPS decryption

[MICHAEL HORNE]

Hello All,

Reading the documentation has led me to understand that the decryption of HTTPS traffic for Content filtering / inspection is not possible and and filtering on for HTTPS traffic will be based only on the host name only.

Can someone just confirm that SSL decryption is not possible?

Many thanks,

Michael

[Philip D'Ath]

>Fortinet firewalls have FPGAs or custom chips to do the heavy lifting in their SSL inspection.

@DHAnderson1 I think that is a great approach that Fortinet are using - if you think SSL inspection has any value.

[DHAnderson]

@Philip D'Ath

When I had a client who had their own servers running an online grocery e-commerce service, they had Fortinet firewalls.

I am installing Meraki MX firewalls for my clients that are not running web servers.

[wrespawn]

Is this on all MXs (i.e MX84 and higher)? I've been considering and actively testing replacing our sonicwalls with Meraki devices. If none of the higher tier devices are able to filter SSL traffic this throws a big wrench into my plans.

[GreenMan]

Correct - SSL decryption is not currently supported on any of the MX models. Sorry this adversely affects your plans.

[ccnewmeraki]

Cisco have announced some interesting products that can detect malware in encrypted traffic without decrypting it:

https://blogs.cisco.com/security/detecting-encrypted-malware-traffic-without-decryption

The whitepaper says it's going to be in Cisco IOS XE 16.6 & it provides a list of models gaining the functionality:

https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/enterprise-network-security/nb-09-encrytd-traf-anlytcs-wp-cte-en.pdf

Are any of these features moving over to the Meraki MX series?

[MRCUR]

@ccnewmeraki I really, really hope the MX team is working on getting this capability into the MX line with AMP. It'd be nice if eventually we could get to a place where Cisco & Meraki can launch these new features in tandem between the traditional Cisco products and the Meraki line.