[177408] in North American Network Operators' Group
Re: HTTPS redirects to HTTP for monitoring
daemon@ATHENA.MIT.EDU (Andy Brezinsky)
Sun Jan 18 09:19:01 2015
X-Original-To: nanog@nanog.org
Date: Sun, 18 Jan 2015 08:18:48 -0600
From: Andy Brezinsky <andy@mbrez.com>
To: nanog@nanog.org
In-Reply-To: <CAPiURgX9jGFQMvVcW2ON1gnUkG1yEF2=n6AqfS9U6HjJu_vWdA@mail.gmail.com>
Errors-To: nanog-bounces@nanog.org
We use Fortinet firewalls and SSL (HTTPS, FTPS, IMAPS, POP3S, SMTPS,
SSH) inspection is a standard feature. It works by rolling out a custom
CA certificate from the device to all of the desktops and whenever you
hit a SSL site, a cert signed with the CA is generated and presented to
the user. If you look at the cert your browser has, you can tell the CA
is different but most users aren't looking at that.
Our user base uses a lot of services that can't be forced to downgrade
to HTTP so it's the only option. Fortinet has some configurations that
allow you to exclude certain sites from the MiTM 'attack'. For example
we don't scan banking, health care and personal privacy categories.
On 01/18/2015 06:29 AM, Grant Ridder wrote:
> Hi Everyone,
>
> I wanted to see what opinions and thoughts were out there. What software,
> appliances, or services are being used to monitor web traffic for
> "inappropriate" content on the SSL side of things? personal use?
> enterprise enterprise?
>
> It looks like Websense might do decryption (
> http://community.websense.com/forums/t/3146.aspx) while Covenant Eyes does
> some sort of session hijack to redirect to non-ssl (atleast for Google) (
> https://twitter.com/CovenantEyes/status/451382865914105856).
>
> Thoughts on having a product that decrypts SSL traffic internally vs one
> that doesn't allow SSL to start with?
>
> -Grant
