SSL Preprocessor Options
Note | The system-provided network analysis policies enable the SSL preprocessor by default. Cisco recommends that you do not disable the SSL preprocessor in custom deployments if you expect encrypted traffic to cross your network. |
Without SSL inspection configured, the system attempts to
inspect encrypted traffic for malware and intrusions without decrypting it.
When you enable the SSL preprocessor, it detects when a session becomes
encrypted. After the SSL preprocessor is enabled, the rules engine can invoke
the preprocessor to obtain SSL state and version information. If you enable
rules using the
ssl_state and
ssl_version keywords in an intrusion policy, you should
also enable the SSL preprocessor in that policy.
Ports
Specifies the ports, separated by commas, where the SSL preprocessor should monitor traffic for encrypted sessions. Only ports specified in this field will be checked for encrypted traffic.
Note | If the SSL preprocessor detects non-SSL traffic over the ports specified for SSL monitoring, it tries to decode the traffic as SSL traffic, and then flags it as corrupt. |
Stop inspecting encrypted traffic
Enables or disables inspection of traffic in a session after the session is marked as encrypted.
Enable this option to disable inspection and reassembly for encrypted sessions. The SSL preprocessor maintains state for the session so it can disable inspection of all traffic in the session. When this option is enabled a few packets of a session are verified to ensure the flow is encrypted after which deep inspection is bypassed. Every bypassed session increases the fast-forwarded flows count shown in the response of the show snort statistics command. Moreover, since deep inspection is bypassed, the initiator and responder bytes in the connection event are not accurate. They are less than the value of the actual session, since it only includes the packets inspected by Snort and it does not include any packets after the deep inspection is bypassed. This behavior holds good for connection summary events and all traffic values shown in the widgets.
The system only stops inspecting traffic in encrypted sessions if both:
-
SSL preprocessing is enabled
-
this option is selected
If you clear this option, you cannot modify the Server side data is trusted option.
Server side data is trusted
When Stop inspecting encrypted traffic is enabled, enables identification of encrypted traffic based only on the client-side traffic,
Max Heartbeat Length
By specifying a number of bytes, enables inspection of heartbeat
requests and responses within the SSL handshake for Heartbleed bug exploit
attempts. You can specify an integer from
1 to
65535, or
0 to disable the option.
If the preprocessor detects a heartbeat request whose payload length is greater than the actual payload length and rule 137:3 is enabled, or a heartbeat response greater in size than the value configured for this option when rule 137:4 is enabled, the preprocessor generates an event and, in an inline deployment, drops offending packets.