Think that I know the author of that post 😁
A couple of clarifications first
- HTTPS Inspection is an intrusive technology in every vendor - I tried Fortinet, PAN, Sophos, Cisco and every each of them has issues. This is due to the fact that to perform Inspection you have to create a Man In the Middle (MITM) situation which may lead to security issues with certain applications and even browsers.
- Inbound and Outbound HTTPS Inspection are two completely different things and shall be approached as different endeavors.
- HTTPS Inspection is something that you have to deploy in your company, no matter the cost.
After stating my points the purpose of my mentioned post is to give advises to properly deploy HTTPS Inspection with less impact as possible. My advise would be to carefully read how to deploy HTTPS Inspection, even try it on a lab first.
Once you did that start deploying Outbound HTTPS Inspection gradually: Know who the problematic/sensitive users are in your company, start by adding certain subnets or even hosts (/32).
The best advise that I could give you is that a certain part of the network being inspected is better than none. I have customers were we managed to achieve 100% traffic visibility while others are in a 60/70%
Last but no least, upgrade at least to R80.40 since there are tons of improvements there regarding HTTPS Inspection (TLS Inspection).
Regards,
Fede
____________
https://www.linkedin.com/in/federicomeiners/