Is SSL inspection required for Intrusion Prevention System to analyze encrypted traffic?

[Joe2]

Hi,

We are only enabling IPS on some firewall policies and I want to verify if SSL inspection is required for IPS to analyze encrypted traffic? Or is IPS capable of performing deep packet inspection without SSL inspection?

I am a bit confused, because the below Fortinet link, mentions: "FortiGate IPS is even capable of performing deep packet inspection to scan encrypted payloads in order to detect and prevent threats from attackers."

Also, that same link mentions: "Secure sockets layer (SSL) content scanning and inspection allows you to apply antivirus scanning, web filtering, and email filtering to encrypted traffic. You can apply SSL inspection profiles to firewall policies." - No mention for IPS.

Reference Link: https://docs.fortinet.com/document/fortigate/6.2.14/cookbook/565562/intrusion-prevention

Whereas the best practice section for IPS in the NSE4 version 7.2 Security Guide (Page 410) mentions: "Certain vulnerabilities apply only to encrypted connections. In some of these cases, FortiGate can't identify the threat reliably if it can't parse the payload. Fort his reason, you must use an SSL inspection profile if you want to maximum benefit from your IPS."

Thanks,

[rosatechnocrat · Accepted solution]

@Joe2 : Yeah that's correct... IPS requires SSL Deep inspection if you want to analyze or protect all traffic.  If there is no SSL Deep packet inspection then https packets or encrypted traffic will not be able to decrypt and might miss IPS analysis. 

[Anthony_E]

Hello Joe,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[rosatechnocrat · Accepted solution]

@Joe2 : Yeah that's correct... IPS requires SSL Deep inspection if you want to analyze or protect all traffic.  If there is no SSL Deep packet inspection then https packets or encrypted traffic will not be able to decrypt and might miss IPS analysis. 

[pavankr5 · Accepted solution]

for the IPS to analyze encrypted traffic, SSL inspection is required. Because SSL encryption is designed to prevent eavesdropping on the content of communications, including potential threats. Without SSL inspection, the IPS would not be able to see the contents of the encrypted traffic, which could potentially hide malicious activity.

It is possible for some IPS systems to perform deep packet inspection without SSL inspection, by using other techniques such as heuristic scanning.

Using SSL inspection profiles in conjunction with IPS is generally recommended for maximum security effectiveness.

[Joe2]

Thank you!

[mbrantev]

Hi everyone, I've been working with Fortinet for several years, and this question has always been something I haven't fully figured out.
I've talked to a couple of NSE7s, even engineers from the brand, and I haven't reached a consensus since I don't always get the same answer.
The last answer I got this year (NSE7) is that the Fortigate IPS acts BEFORE the connection is established (being a filter that will decide whether the connection is established or not).
Once the IPS makes this decision, it doesn't perform subsequent inspections once the connection is established, so deep SSL inspection would not be necessary.

Maybe someone can go a little deeper here and shed some light on this.

@rosatechnocrat @pavankr5 

Thanks in advance!

[rosatechnocrat]

@mbrantev: While some of what you mentioned is correct, the requirement for deep inspection depends on the application profile or UTM profiles you are using.

• IPS Inspection: If you're only using IPS inspection, deep SSL inspection may not be necessary.

• Web Filter & Application Profiles: However, if you're using Web Filter and Application Control profiles, deep inspection may be required.

Without deep packet inspection, FortiGate might not accurately detect web filter categories or applications, especially if tunneling or other bypassing techniques are being used.

So, the necessity for deep packet inspection really depends on what you want to achieve and the specific requirements of your security setup.

[mbrantev]

@rosatechnocrat Hi! thanks for your reply.
Sure (I should have mentioned that), I'm specifically referring to scenarios where only IPS is used.
If the analysis is correct, and if after the connection is established, the IPS will not do further inspections, there is no point in SSL deep inspection, however FortiOS still warns you to enable SSL/DPI even when only using IPS.
That leaves a big question when you have to size equipment for IPS use only.