AnsweredAssumed Answered

fwmonitor on decrypted traffic

Question asked by Marcel Wildenberg on Dec 6, 2018
Latest reply on Dec 7, 2018 by Dameon Welch-Abernathy

Like • Show 0 Likes0
Comment • 3

CheckMates,

In order to troubleshoot, is there a way to fwmonitor traffic decrypted by HTTPS Inspection?

I am aware of the fact that it is only decrypted in the box: it will enter and leave the box encrypted. I am aware of the fact that it is bordering (malicious) MitM functionality, but it is sometimes essential to analysis.

No one else has this question

Outcomes

3 Replies

Dameon Welch-Abernathy Dec 6, 2018 4:13 PM
Mark Correct
Correct Answer
One of the features we added to R80.20 is "Mirror Decrypt and Forward."
This would allow you to look at decrypted traffic, but it would be sent out a specific interface.
So it is possible to see the traffic, but I don't think you can with fw monitor.
Like • Show 0 Likes0
Actions
Marcel Wildenberg Dec 7, 2018 1:14 AM
Mark Correct
Correct Answer
Ok, sounds like a useful option. Once you can send it to an interface, you can tcpdump it, I guess.
Like • Show 0 Likes0
Actions
- Dameon Welch-Abernathy @ Marcel Wildenberg on Dec 7, 2018 6:10 AM
  Mark Correct
  Correct Answer
  The use case for the feature is sending the unencrypted traffic to another system for analysis or archive.
  And sure, you could probably tcpdump it also.
  Like • Show 0 Likes0
  Actions

fwmonitor on decrypted traffic

Outcomes

Related Content

Recommended Content