https scanning through IPS

[vikasgupta2k]

Is it possible to scan all the https traffic passing through AIP module installed on ASA (inbound and outbound)?

[Federico Coto Fajardo]

Hi,

You can inspect the HTTPS traffic passing through the IPS module on the ASA.

But you need to know that since HTTPS is encrypted, the IPS will not be able to ''read'' the contents of the packet.

So, you can monitor the behavior of the HTTPS traffic, and so on, but you cannot decrypt and obtain the original content (data) of the packets.

Federico.

[vikasgupta2k]

Is there any formal documentation from Cisco on this that I can present to the customer?

[Federico Coto Fajardo]

I'm not sure that I've seen a document.

It's the same with any cryptographic protocol (HTTPS, SSH, ISAKMP, SFTP, etc.)

Anything that goes encrypted can't be ''read'' since you would have to be able to decrypted prior to sending the traffic to the IPS for scanning.

Federico.