topic IPS without HTTS inspection in Firewall and Security Management

IPS without HTTS inspection

mariuszchlebow — Mon, 18 Jan 2021 13:24:14 GMT

Hello,

Is there any document I can follow to understand how IPS works without HTTPS inspection enabled?

Re: IPS without HTTS inspection

the_rock — Mon, 18 Jan 2021 19:38:45 GMT

Hi Marius,

Maybe you can clarify the question...when it comes to IPS, I dont believe functionality changes regardless if https inspection is used or not. Really, say if you dont use inspection, then gateway wont be aware of the content that is going through the ssl encrypted tunnel, thats all.

Andy

Re: IPS without HTTS inspection

JackPrendergast — Mon, 18 Jan 2021 23:26:55 GMT

Hi Marius,

Threat Prevention blades will scan whatever it can see. Without HTTPS inspection, it will be minimal these days.

Traffic that is subject to scanning via the Threat Prevention blades will traverse the PXL (medium) path eventually.

Please use this info for your future studies, or drop a line below for anything else 🙂

Re: IPS without HTTS inspection

the_rock — Tue, 19 Jan 2021 00:45:46 GMT

I would not agree totally that it would be minimal...it will scan based on whats enabled : )

Re: IPS without HTTS inspection

mariuszchlebow — Tue, 19 Jan 2021 07:46:28 GMT

Hi Jack,

Thank you. Can we say that all what's encrypted will not be matched by application vulnerabilities signatures? CP IPS is only aware of unencrypted application layer and network layer 3/4 behaviour, right?

Re: IPS without HTTS inspection

MartinTzvetanov — Tue, 19 Jan 2021 14:13:47 GMT

correct