Skip to main content
Joe2
Joe2
Explorer
May 8, 2023
Solved

Is SSL inspection required for Intrusion Prevention System to analyze encrypted traffic?

  • May 8, 2023
  • 5 replies
  • 19564 views

Hi,

 

We are only enabling IPS on some firewall policies and I want to verify if SSL inspection is required for IPS to analyze encrypted traffic? Or is IPS capable of performing deep packet inspection without SSL inspection?

 

I am a bit confused, because the below Fortinet link, mentions: "FortiGate IPS is even capable of performing deep packet inspection to scan encrypted payloads in order to detect and prevent threats from attackers."

Also, that same link mentions: "Secure sockets layer (SSL) content scanning and inspection allows you to apply antivirus scanning, web filtering, and email filtering to encrypted traffic. You can apply SSL inspection profiles to firewall policies." - No mention for IPS.

Reference Link: https://docs.fortinet.com/document/fortigate/6.2.14/cookbook/565562/intrusion-prevention

 

Whereas the best practice section for IPS in the NSE4 version 7.2 Security Guide (Page 410) mentions: "Certain vulnerabilities apply only to encrypted connections. In some of these cases, FortiGate can't identify the threat reliably if it can't parse the payload. Fort his reason, you must use an SSL inspection profile if you want to maximum benefit from your IPS."

 

Thanks,

Best answer by pavankr5

for the IPS to analyze encrypted traffic, SSL inspection is required. Because SSL encryption is designed to prevent eavesdropping on the content of communications, including potential threats. Without SSL inspection, the IPS would not be able to see the contents of the encrypted traffic, which could potentially hide malicious activity.

It is possible for some IPS systems to perform deep packet inspection without SSL inspection, by using other techniques such as heuristic scanning.

Using SSL inspection profiles in conjunction with IPS is generally recommended for maximum security effectiveness.

5 replies

Anthony_E
Staff
Anthony_E
Staff
May 11, 2023

Hello Joe,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Best Regards
rosatechnocrat
rosatechnocrat
Explorer III
May 11, 2023

@Joe2 : Yeah that's correct... IPS requires SSL Deep inspection if you want to analyze or protect all traffic.  If there is no SSL Deep packet inspection then https packets or encrypted traffic will not be able to decrypt and might miss IPS analysis. 

Subscribe "ROSA Technocrat" on Youtube for Fortinet Videos and Troubleshooting https://www.youtube.com/@rosatechnocrat
    pavankr5
    Staff
    pavankr5Answer
    Staff
    May 12, 2023

    for the IPS to analyze encrypted traffic, SSL inspection is required. Because SSL encryption is designed to prevent eavesdropping on the content of communications, including potential threats. Without SSL inspection, the IPS would not be able to see the contents of the encrypted traffic, which could potentially hide malicious activity.

    It is possible for some IPS systems to perform deep packet inspection without SSL inspection, by using other techniques such as heuristic scanning.

    Using SSL inspection profiles in conjunction with IPS is generally recommended for maximum security effectiveness.

      Joe2
      Joe2Author
      Explorer
      June 6, 2023

      Thank you!

      mbrantev
      mbrantev
      New Member
      September 2, 2024

      Hi everyone, I've been working with Fortinet for several years, and this question has always been something I haven't fully figured out.
      I've talked to a couple of NSE7s, even engineers from the brand, and I haven't reached a consensus since I don't always get the same answer.
      The last answer I got this year (NSE7) is that the Fortigate IPS acts BEFORE the connection is established (being a filter that will decide whether the connection is established or not).
      Once the IPS makes this decision, it doesn't perform subsequent inspections once the connection is established, so deep SSL inspection would not be necessary.

      Maybe someone can go a little deeper here and shed some light on this.

       

      @rosatechnocrat @pavankr5 

       

      Thanks in advance!

      rosatechnocrat
      rosatechnocrat
      Explorer III
      September 3, 2024

      @mbrantev: While some of what you mentioned is correct, the requirement for deep inspection depends on the application profile or UTM profiles you are using.

      • IPS Inspection: If you're only using IPS inspection, deep SSL inspection may not be necessary.

      • Web Filter & Application Profiles: However, if you're using Web Filter and Application Control profiles, deep inspection may be required.

      Without deep packet inspection, FortiGate might not accurately detect web filter categories or applications, especially if tunneling or other bypassing techniques are being used.

      So, the necessity for deep packet inspection really depends on what you want to achieve and the specific requirements of your security setup.

      Subscribe "ROSA Technocrat" on Youtube for Fortinet Videos and Troubleshooting https://www.youtube.com/@rosatechnocrat
      mbrantev
      mbrantev
      New Member
      September 3, 2024

      @rosatechnocrat Hi! thanks for your reply.
      Sure (I should have mentioned that), I'm specifically referring to scenarios where only IPS is used.
      If the analysis is correct, and if after the connection is established, the IPS will not do further inspections, there is no point in SSL deep inspection, however FortiOS still warns you to enable SSL/DPI even when only using IPS.
      That leaves a big question when you have to size equipment for IPS use only.

      Terms & ConditionsAccessibility statement