Differences between Monitor and Decrypt actions in Decryption Policies

[jose cortes]

Hi Everybody,

Currently I'm working in my first WSA (S170) implementation and some questions has popped up while I was configuring the Decryption policies. The main question here is:

What are the differences between "monitor" and "decrypt" in the URL Filtering options. As I understand the "decrypt" action allows the WSA to decrypt the packet and treats it like a plain HTTP packet applying the Access Policies, malware inspection and so on. Then I do not really know what the Monitor option does, I'm assuming that it does not decrypt the packet and only checks the destination URL and to allow or not the connection.

Thanks in advance for your collaboration.

Jose M. Cortes H.

[Ken Stieers · Accepted solution]

If you set it for Decrypt, it always decrypts stuff in that category.

If you set it to monitor, then other criteria in the policy are used for whether to decrypt or not, such as Web Reputation...

Here's the flow, which I pulled from the online help:

https://wsaip:port/help/wsa_help/index.html?Decryption_policies11.html#wp1208329