Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Encrypted traffic inspected by IPS ?

Dear All

We are having following scenario at one of the customers

ISP Link -> L2 Switch -> IPS in Inline (VLAN)Mode -> PIX Firewall

There are lot of Site to Site VPN tunnels terminated on the PIX Firewall; hence please let me know if the VPN traffic towards firewall will be inspected by IPS and if yes how will the signature analysis happen for it i.e whether IPS will really be able to undertstand the encrypted traffic ?

Regards

Ankur

1 REPLY
Cisco Employee

Re: Encrypted traffic inspected by IPS ?

Ankur,

The IPS will inspect the encrypted traffic but does not have the ability to look inside the encryption; it generally cannot understand the encrypted traffic; so all the inspection can do is IP Header type inspections like sweeps, floods, and "impossible IP packet" type checks. It may also do L4 inspections depending on your VPN technology...but the encrypted data is still opaque (cannot be understood). Any clear (non-vpn) traffic is still inspected; the meer presence of VPN does not affect non-VPN inspection.

To inspect the data that is traversing the VPN's, you'd need to put an IPS inline behind the PIX (post VPN termination).

Scott

246
Views
5
Helpful
1
Replies