Encrypted traffic inspected by IPS ?

Unanswered Question
Jul 8th, 2008

Dear All

We are having following scenario at one of the customers

ISP Link -> L2 Switch -> IPS in Inline (VLAN)Mode -> PIX Firewall

There are lot of Site to Site VPN tunnels terminated on the PIX Firewall; hence please let me know if the VPN traffic towards firewall will be inspected by IPS and if yes how will the signature analysis happen for it i.e whether IPS will really be able to undertstand the encrypted traffic ?

Regards

Ankur

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
scothrel Tue, 07/08/2008 - 11:57

Ankur,

The IPS will inspect the encrypted traffic but does not have the ability to look inside the encryption; it generally cannot understand the encrypted traffic; so all the inspection can do is IP Header type inspections like sweeps, floods, and "impossible IP packet" type checks. It may also do L4 inspections depending on your VPN technology...but the encrypted data is still opaque (cannot be understood). Any clear (non-vpn) traffic is still inspected; the meer presence of VPN does not affect non-VPN inspection.

To inspect the data that is traversing the VPN's, you'd need to put an IPS inline behind the PIX (post VPN termination).

Scott

Actions

This Discussion