About Inline SSL Decryption

Inline SSL decryption provides the following:

•

Identifies/detects encrypted traffic flows (SSL traffic) in a network across any port.

•

Intercepts encrypted traffic flows between a client and a server.

•

Filters encrypted traffic flows based on policy. For example, if the encrypted traffic flows contain health care or financial information, let those flows bypass decryption.

•

Decrypts packets. Inline SSL decryption decrypts packets once at a single decryption point.

•

Delivers decrypted traffic flows to multiple security tools. The tools can be inline or out-of-band. The tools can detect threats such as malware in the decrypted traffic flows.

•

Re-encrypts traffic flows after receiving them back from the inline tools.

•

If a tool acts on traffic flows based on the threats it finds, when malware is found in the decrypted traffic flows, the tool can:

•

modify the traffic flows

•

terminate the connection

•

If the tool modifies the packets, GigaSMART will re-encrypt them. If the tool terminates the connection, GigaSMART will terminate the connection between the client and the server.

When SSL traffic is decrypted, sensitive data will be exposed in the connected tools. For example, if email traffic is decrypted, user passwords might be exposed or if financial data is decrypted, social security numbers might be exposed in the decrypted traffic.

Because SSL connections might carry sensitive data, not all connections should be inspected. Some of the SSL connections carrying user data such as financial or medical information should be bypassed without inspection, based on a configured policy.

Inline SSL decryption addresses acceptable use policies and adheres to privacy and compliance requirements. It offers advanced controls to select the traffic to decrypt.

Inline SSL supports the following applications:

• HTTPS
• FTPS
• StartTLS can be used to decrypt SMTP, IMAP, and POP3 (refer to StartTLS )

This following list describes important caveats and limitations of working with Inline SSL:

• Clustering is not supported with inline SSL.
• IPv6 is not supported. Only IPv4 addresses are supported.
• Inline-tool in Layer 3 mode is not supported. Inline-tool cannot change VLAN, mac-address, IP-address, port number.
• Gigamon Resiliency for Inline Protection (GRIP) is not supported.
• Resilient Inline Arrangements (RIA) configurations are not supported.

Note:  Inline SSL is not supported in clusters nor on any nodes that are part of a cluster. Do not attempt to enable inline SSL on individual nodes that are part of a cluster or have inline networks and inline tools distributed among various nodes in a cluster.

Inline SSL decryption supports modern cryptographic algorithms. It supports the commonly-supported TLS 1.2 ciphers.

Combining the following ciphers, MACs, and Key Exchange Algorithms results in many cipher suites:

•

Ciphers: RC4_128, DES_CBC, 3DES_EDE_CBC, AES_128_CBC, AES_128_GCM, AES_256_GCM, AES_256_CBC, Camellia, Chacha20

•

MAC: MD5, SHA, SHA256, SHA384, Poly1305

•

Key Exchange Algorithms: RSA, DHE_RSA, ECDHE_RSA, ECDHE_ECDSA

Inline SSL Supported TLS 1.2 Ciphers

Cipher Name	Key Exchange (Kx)	Authentication (Au)	Encryption (Enc)	MAC
TLS_RSA_EXPORT_WITH_RC4_40_MD5	RSA_EXPORT	RSA_EXPORT	RC4_40	MD5
TLS_RSA_WITH_RC4_128_MD5	RSA	RSA	RC4_128	MD5
TLS_RSA_WITH_RC4_128_SHA	RSA	RSA	RC4_128	SHA
TLS_RSA_EXPORT_WITH_DES40_CBC_SHA	RSA_EXPORT	RSA_EXPORT	DES40_CBC	SHA
TLS_RSA_WITH_DES_CBC_SHA	RSA	RSA	DES_CBC_	SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA	RSA	RSA	3DES_EDE_CBC	SHA
TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA	DHE	RSA_EXPORT	DES40_CBC	SHA
TLS_DHE_RSA_WITH_DES_CBC_SHA	DHE	RSA	DES_CBC	SHA
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA	DHE	RSA	3DES_EDE_CBC	SHA
TLS_RSA_WITH_AES_128_CBC_SHA	RSA	RSA	AES_128_CBC	SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA	DHE	RSA	AES_128_CBC	SHA
TLS_RSA_WITH_AES_256_CBC_SHA	RSA	RSA	AES_256_CBC	SHA
TLS_DHE_RSA_WITH_AES_256_CBC_SHA	DHE	RSA	AES_256_CBC	SHA
TLS_RSA_WITH_AES_128_CBC_SHA256	RSA	RSA	AES_128_CBC	SHA256
TLS_RSA_WITH_AES_256_CBC_SHA256	RSA	RSA	AES_256_CBC	SHA256
TLS_RSA_WITH_CAMELLIA_128_CBC_SHA	RSA	RSA	CAMELLIA_128_CBC	SHA
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA	DHE	RSA	CAMELLIA_128_CBC	SHA
TLS_RSA_EXPORT1024_WITH_RC4_MD5	RSA_EXPORT 1024	RSA_EXPORT 1024	RC4	MD5
TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA	RSA_EXPORT 1024	RSA_EXPORT 1024	DES_CBC	SHA
TLS_RSA_EXPORT1024_WITH_RC4_SHA	RSA_EXPORT 1024	RSA_EXPORT 1024	RC4_	SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256	DHE	RSA	AES_128_CBC	SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256	DHE	RSA	AES_256_CBC	SHA256
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA	RSA	RSA	CAMELLIA_256_CBC	SHA
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA	DHE	RSA	CAMELLIA_256_CBC	SHA
TLS_RSA_WITH_SEED_CBC_SHA	RSA	RSA	SEED_CBC	SHA
TLS_DHE_RSA_WITH_SEED_CBC_SHA	DHE	RSA	SEED_CBC	SHA
TLS_RSA_WITH_AES_128_GCM_SHA256	RSA	RSA	AES_128_GCM	SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384	RSA	RSA	AES_256_GCM	SHA384
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256	DHE	RSA	AES_128_GCM	SHA256
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384	DHE	RSA	AES_256_GCM	SHA384
TLS_ECDHE_ECDSA_WITH_RC4_SHA	ECDHE	ECDSA	RC4	SHA
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA	ECDHE	ECDSA	3DES_EDE_CBC	SHA
TLS_ECDHE_ECDSA_WITH_AES128_CBC_SHA	ECDHE	ECDSA	AES128_CBC	SHA
TLS_ECDHE_ECDSA_WITH_AES256_CBC_SHA	ECDHE	ECDSA	AES256_CBC	SHA
TLS_ECDHE_RSA_WITH_RC4_SHA	ECDHE	RSA	RC4	SHA
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA	ECDHE	RSA	3DES_EDE_CBC	SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA	ECDHE	RSA	AES_128_CBC	SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA	ECDHE	RSA	AES_256_CBC	SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256	ECDHE	ECDSA	AES_128_CBC	SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384	ECDHE	ECDSA	AES_256_CBC	SHA384
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256	ECDHE	RSA	AES_128_CBC	SHA256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384	ECDHE	RSA	AES_256_CBC	SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256	ECDHE	ECDSA	AES_128_GCM	SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384	ECDHE	ECDSA	AES_256_GCM	SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256	ECDHE	RSA	AES_128_GCM	SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384	ECDHE	RSA	AES_256_GCM	SHA384
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305	ECDHE	RSA	CHACHA20	POLY1305
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305	ECDHE	ECDSA	CHACHA20	POLY1305
TLS_DHE_RSA_WITH_CHACHA20_POLY1305	DHE	RSA	CHACHA20	POLY1305

Diffie Hellman Ephemeral (DHE) is a key exchange protocol.

Inline SSL decryption supports key cipher suites and exchanges without downgrading cryptography levels of the organization.

Ciphersuites are a standard combination of the following:

•

bulk encryption algorithm—Specifies how to encrypt communications, including the algorithm, key size, and the cryptographic mode used. For example, AES_128_CBC is AES with 128-bit keys in Cipher Block Chaining mode.

•

key exchange algorithm—Specifies how both sides authenticate each other during the SSL handshake. For example, RSA.

•

message authentication code (MAC)—Specifies the hash algorithm used to verify that communications have not been tampered with. For example, SHA.

•

pseudorandom function—Specifies how a 384-bit master secret, which is used as a source of randomness for session keys, is generated.

The following key sizes are supported:

•

RSA—512, 1024, 2048, 3072, 4096, 8192

•

DH—1024, 2048, 4096

•

ECC—prime256v1, ecsecp256r1, ecsecp384r1, ecsecp521r1

The following TLS extension is supported:

•

RFC7301—Application-Layer Protocol Negotiation (ALPN)

Refer to the following sections for additional details:

• SSL Decryption for Inline Tools
• Example Inline SSL Decryption
• SSL Sessions
• SSL Terminology and Acronyms