How to understand Decrypt, No Decrypt or Pass Through option ?

[Rps-Cheers]

How to understand Decrypt, No Decrypt or Pass Through option in Cisco SDWAN TLS/SSL Profile?

If you choose URLs, enter the following:

VPNs

TLS/SSL profile.

Enter a name for the profile.

Choose Decrypt, No Decrypt or Pass Through. Alternatively, you can choose multiple categories and set the action for all of them using the actions drop-down menu.

https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/security/ios-xe-17/security-book-xe/m-ssl-proxy.html

[Rps-Cheers · Accepted solution]

• drop: If the verdict is drop, the hello packet from the client is dropped and the connection is reset.

• do-not-decrypt: If the verdict is do-not-decrypt, the hello packet bypasses TLS proxy.

• decrypt: If the verdict is decrypt, the packet is forwarded to the client and goes through the following:

TCP optimization for optimization of traffic

Decryption of encrypted traffic through TLS proxy

Threat inspection through UTD

Re-encryption of decrypted traffic through TLS proxy

Note        

If there is a delay in determining the decrypt status of the flow, the UTD configuration for fail-decrypt is exercised.