topic Re: fwmonitor on decrypted traffic in General Topics

fwmonitor on decrypted traffic

Marcel_Wildenbe — Thu, 06 Dec 2018 12:54:34 GMT

CheckMates,

In order to troubleshoot, is there a way to fwmonitor traffic decrypted by HTTPS Inspection?

I am aware of the fact that it is only decrypted in the box: it will enter and leave the box encrypted. I am aware of the fact that it is bordering (malicious) MitM functionality, but it is sometimes essential to analysis.

Re: fwmonitor on decrypted traffic

PhoneBoy — Fri, 07 Dec 2018 00:13:57 GMT

One of the features we added to R80.20 is "Mirror Decrypt and Forward."

This would allow you to look at decrypted traffic, but it would be sent out a specific interface.

So it is possible to see the traffic, but I don't think you can with fw monitor.

Re: fwmonitor on decrypted traffic

Marcel_Wildenbe — Fri, 07 Dec 2018 09:14:40 GMT

Ok, sounds like a useful option. Once you can send it to an interface, you can tcpdump it, I guess.

Re: fwmonitor on decrypted traffic

PhoneBoy — Fri, 07 Dec 2018 14:10:05 GMT

The use case for the feature is sending the unencrypted traffic to another system for analysis or archive.

And sure, you could probably tcpdump it also.