Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Https filtering

Hi All,

How the enterprzes are doing the https filtering? for the https filtering, you need to decrypt the packet to evaluate its contents for the filtering and if you do it then its like a man in the middle attack. There are devices available to do the https filtering doing deep packet inspection technology but how they cope with the legal legislation for financial sector. like people are using https bank sites to made transactions and if you are decrypting the packet then you will act like a man in the middle. Correct me if i am wrong. your explanation on this will be much appriciated.


Cisco Employee

Re: Https filtering

There are 2 ways to do https filtering:

- You can do reverse dns. For example if a host is going to an ip address on port 443,  you can do reverse dns and see the domain of that ip and allow it or not. Devices like that are filtering devices that the ASA supports. Sch methods don't proxy as a man in the middle.

- You can be a man in the middle as you are saying. One of the first devices that introduced this functionality is the Ironport WSA. Of course having the mad in the middle introduces the concerns that you mention. But if you trust the certificate of the device that proxies then you can trust the transaction also.

I hope it helps.


CreatePlease to create content