Where to find information about SSL decryption is (not) required to identified traffic

[A.Molter]

Hello guys,

I want to know if there is a resource where I can find if SSL decryption is required or not to identified the APP traffic. 

I have this information inside Palo Alto Networks Content Update mail but I don't find this information in applipedia or somewhere else.

Anybody have an idea  ?

Best,

Alexis

[JayGolf]

Hi @A.Molter ,

SSL Decryption is required for application traffic that is encrypted by SSL/TLS, if you would like to truly identify what the underlying application is. If you go onto your monitor tab and view traffic from your trust zone to the untrust zone, you will likely find a number of connections that have the app-id "ssl". Without decryption, you don't really know what type of application the connection is because the firewall can't inspect the encrypted payload. The employee could be watching a cnn video or a youtube video. 

I would recommend taking a look at how much SSL traffic traverses any firewall you might have that sits at the edge. Head over to your ACC tab on your firewall. Then click on SSL activity and set the time frame to last 90 days. How much SSL traffic do you see? How does it compare to other traffic? There is all your application traffic that hides behind encryption. 

I would recommend reading Decryption Basics and Decryption best practices.

[A.Molter]

Hello @JayGolf ,

Thanks for all thoses advices.

But I just want to know if there is a documentation about what applications required decryption to be identified and what not. 

I am surprised to find this information inside Palo Alto Networks Content Update newsletter but not in the applipedia.

This can be helpful to understand what applications can be block or allow in network without decryption.