Monitor TLS versions outbound and inbound traffic passing through a gateway

[Tiger_QAs]

Is there a recommended way to monitor which connections are using TLS1.0 / TLS1.1 / TLS 1.2 ?

Does SSL inspection have to be enabled for TLS traffic analysis ?

Use case: If we have to make TLSv1.2 mandatory we would like to know the current usage of all the versions.

[PhoneBoy]

I believe there are IPS signatures for the various TLS versions.
You can enable them in detect mode to see which clients are using them.

[Benedikt_Weissl]

Does SSL inspection have to be enabled for TLS traffic analysis ?

No, but you need AppControl. There are predefined Services for TLS1.0 to TLS1.2. I had to manually enable the protocol signature in the advanced tab of the serivce, so check that before installation.