About Inline SSL Decryption
This section introduces inline SSL decryption.
Inline SSL decryption provides the following:
Identifies/detects encrypted traffic flows (SSL traffic) in a network across any port. |
Intercepts encrypted traffic flows between a client and a server. |
Filters encrypted traffic flows based on policy. For example, if the encrypted traffic flows contain health care or financial information, let those flows bypass decryption. |
Decrypts packets. Inline SSL decryption decrypts packets once at a single decryption point. |
Delivers decrypted traffic flows to multiple security tools. The tools can be inline or out-of-band. The tools can detect threats such as malware in the decrypted traffic flows. |
Re-encrypts traffic flows after receiving them back from the inline tools. |
If a tool acts on traffic flows based on the threats it finds, when malware is found in the decrypted traffic flows, the tool can: |
modify the traffic flows |
terminate the connection |
If the tool modifies the packets, GigaSMART will re-encrypt them. If the tool terminates the connection, GigaSMART will terminate the connection between the client and the server. |
When SSL traffic is decrypted, sensitive data will be exposed in the connected tools. For example, if email traffic is decrypted, user passwords might be exposed or if financial data is decrypted, social security numbers might be exposed in the decrypted traffic.
Because SSL connections might carry sensitive data, not all connections should be inspected. Some of the SSL connections carrying user data such as financial or medical information should be bypassed without inspection, based on a configured policy.
Inline SSL decryption addresses acceptable use policies and adheres to privacy and compliance requirements. It offers advanced controls to select the traffic to decrypt.
Inline SSL supports the following applications:
- HTTPS
- FTPS
- StartTLS can be used to decrypt SMTP, IMAP, and POP3 (refer to StartTLS and HTTP CONNECT.
This following list describes important caveats and limitations of working with Inline SSL:
- Clustering is not supported with inline SSL.
- IPv6 is not supported. Only IPv4 addresses are supported.
- Inline-tool in Layer 3 mode is not supported. Inline-tool cannot change VLAN, mac-address, IP-address, port number.
- Gigamon Resiliency for Inline Protection (GRIP) support with inline SSL can be referred through the validated design Active Standby Resilient Inline SSL Solution using GRIP (5.10.01).
- Resilient Inline Arrangements (RIA) configurations is supported with inline SSL for asymmetric traffic visibility with SSL Decryption.
Note: Inline SSL is not supported in clusters nor on any nodes that are part of a cluster. Do not attempt to enable inline SSL on individual nodes that are part of a cluster or have inline networks and inline tools distributed among various nodes in a cluster.
Inline SSL decryption supports modern cryptographic algorithms. It supports the commonly-supported TLS 1.2 and TLS 1.3 ciphers.
Combining the following ciphers, MACs, and Key Exchange Algorithms results in many cipher suites:
Ciphers: AES_128_CBC, AES_128_GCM, AES_256_GCM, AES_256_CBC, Camellia, Chacha20 |
MAC: SHA, SHA256, SHA384, Poly1305 |
Key Exchange Algorithms: RSA, DHE_RSA, ECDHE_RSA, ECDHE_ECDSA |
Cipher Name |
Encryption (Enc) |
MAC |
TLS_AES_256_GCM_SHA384 |
AES_ 256_GCM |
SHA384 |
TLS_CHACHA20_POLY1305_SHA256 |
CHACHA20_POLY1305 |
SHA256 |
TLS_AES_128_GCM_SHA256 |
AES_128_GCM |
SHA256 |
Cipher Name |
Key Exchange (Kx) |
Authentication(Au) |
Encryption (Enc) |
MAC |
TLS_DHE_RSA_WITH_AES_128_CBC_SHA | DHE | RSA | AES128_CBC | SHA |
TLS_DHE_RSA_WITH_AES_256_CBC_SHA | DHE | RSA | AES256_CBC | SHA |
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA | DHE | RSA | CAMELLIA128 | SHA |
TLS_RSA_WITH_CAMELLIA_128_CBC_SHA | RSA | RSA | CAMELLIA128 | SHA |
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA | RSA | RSA | CAMELLIA256 | SHA |
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA | DHE | RSA | CAMELLIA256 | SHA |
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 | DHE | RSA | AES128_CBC | SHA256 |
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 | DHE | RSA | AES256_CBC | SHA256 |
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 | DHE | RSA | AES128_GCM | SHA256 |
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | DHE | RSA | AES256_GCM | SHA384 |
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 | ECDHE | RSA | CHACAH20 | POLY1305 |
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 | ECDHE | ECDSA | CHACAH20 | POLY1305 |
TLS_DHE_RSA_WITH_CHACHA20_POLY1305 | DHE | RSA | CHACAH20 | POLY1305 |
TLS_RSA_WITH_AES_128_CBC_SHA | RSA | RSA | AES128_CBC | SHA |
TLS_RSA_WITH_AES_256_CBC_SHA | RSA | RSA | AES256_CBC | SHA |
TLS_RSA_WITH_AES_128_CBC_SHA256 | RSA | RSA | AES128_CBC | SHA256 |
TLS_RSA_WITH_AES_256_CBC_SHA256 | RSA | RSA | AES256_CBC | SHA256 |
TLS_RSA_WITH_AES_128_GCM_SHA256 | RSA | RSA | AES128_GCM | SHA256 |
TLS_RSA_WITH_AES_256_GCM_SHA384 | RSA | RSA | AES256_GCM | SHA384 |
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA | ECDHE | ECDSA | AES128_CBC | SHA |
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA | ECDHE | ECDSA | AES256_CBC | SHA |
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | ECDHE | RSA | AES128_CBC | SHA |
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | ECDHE | RSA | AES256_CBC | SHA |
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 | ECDHE | ECDSA | AES128_CBC | SHA256 |
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 | ECDHE | ECDSA | AES256_CBC | SHA384 |
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | ECDHE | RSA | AES128_CBC | SHA256 |
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | ECDHE | RSA | AES256_CBC | SHA384 |
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 | ECDHE | ECDSA | AES128_GCM | SHA256 |
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 | ECDHE | ECDSA | AES256_GCM | SHA384 |
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | ECDHE | RSA | AES128_GCM | SHA256 |
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | ECDHE | RSA | AES256_GCM | SHA384 |
Diffie Hellman Ephemeral (DHE) is a key exchange protocol.
Inline SSL decryption supports key cipher suites and exchanges without downgrading cryptography levels of the organization.
Ciphersuites are a standard combination of the following:
bulk encryption algorithm—Specifies how to encrypt communications, including the algorithm, key size, and the cryptographic mode used. For example, AES_128_CBC is AES with 128-bit keys in Cipher Block Chaining mode. |
key exchange algorithm—Specifies how both sides authenticate each other during the SSL handshake. For example, RSA. |
message authentication code (MAC)—Specifies the hash algorithm used to verify that communications have not been tampered with. For example, SHA. |
pseudorandom function—Specifies how a 384-bit master secret, which is used as a source of randomness for session keys, is generated. |
Note
- SSL transactions with unsupported ciphers will be bypassed/TCP proxied.
- The new TLS1.3 cipher suites are defined differently and do not specify the certificate types (RSA/DSA/ECDSA) or the key exchange mechanism (DHE/ECHDE).
The following key sizes are supported:
RSA—2048, 3072, 4096, 8192 |
DH—1024, 2048, 4096 |
ECC—prime256v1, ecsecp256r1, ecsecp384r1, ecsecp521r1, secp160k1, secp160r1, secp160r2, secp192k1, secp192r1, secp224k1, secp224r1, secp256k1, secp256r1, secp384r1, secp521r1, brainpoolP256r1, brainpoolP384r1, brainpool512r1, X25519, X448 |
The following TLS extension is supported:
RFC7301—Application-Layer Protocol Negotiation (ALPN) |
Refer to the following sections for additional details: