What ist the benefit of IPS, Zero-Day Protection, ATP and web filtering without deep packet inspection on TLS sessions

Hello Dr No ,
Thank you for reaching out to the community, With intrusion prevention, you can examine network traffic for anomalies to prevent DoS and other spoofing attacks. Using policies, you can define rules that specify an action to take when traffic matches signature criteria. In addition to blocking risky files, zero-day protection also provides detailed reports of the analysis performed to help you understand the risk. Advanced threat protection analyzes incoming and outgoing network traffic for threats. Using ATP, you can quickly detect compromised clients in your network and log or drop the traffic from those devices. Further more we recommend a read - the new DPI Engine for web proxy explained. Additionally you can refer the License bundles are available for XGS and XG Series firewalls.

Hello Dr No ,
Thank you for reaching out to the community, With intrusion prevention, you can examine network traffic for anomalies to prevent DoS and other spoofing attacks. Using policies, you can define rules that specify an action to take when traffic matches signature criteria. In addition to blocking risky files, zero-day protection also provides detailed reports of the analysis performed to help you understand the risk. Advanced threat protection analyzes incoming and outgoing network traffic for threats. Using ATP, you can quickly detect compromised clients in your network and log or drop the traffic from those devices. Further more we recommend a read - the new DPI Engine for web proxy explained. Additionally you can refer the License bundles are available for XGS and XG Series firewalls.

thanks, a good insight between these implementations.

But as I tried to describe: what would be the benefit of all these technologies if one does not break outgoing TLS connections at all? And this it what happens in real world nearly to 100%, I really do not know any customer who does it.

Don't know what's the problem...
Default (depending on settings) is decrypt all except trusted sites, services I know, incompatible services (...) and it's working. Of course you can set brake all SSL connections without exceptions -> have fun (and you will have that problem with any firewall). By the way a lot of services are not using SSL encryption and also protecting you. You have to know whether the few percent more security is worth it to you.

The firewall is just ONE point of security and no egg-laying wooly-milk-pig, there are many other points (inlcuding Layer 8) to care about for reaching a good level of security. If you assume a single the firewall will protect you from all bad things, maybe you are wrong...

main problem after a security breach is the internet connection and yes, detection, alert and even response here is essential I would say. Sure, best approach is a layered approach, but keep in mind where is the plot of the story. It's the internet connection and access via c&c and so on.

I have no problem, I understand the purpose of DPI, but I was curious how others handle this in practice.

As I said: I know nobody who does, that is why I am asking.

Most customers are adapting this technology right now. At least for the German Market, the administrators are using the Company employee agreement to get HTTPS Scanning enabled which means - Employees are aware that IT can read everything and personal usage is under the terms of services for the network. This is also approved by the work council of a company as well. (I mean we are living in this situation for Emails as well for years - Admins can read Emails of each employee without an problem, therefore there has to be an regulation - The same is applicable for decrypting HTTPS). 

The next point is: SFOS can do certain protection levels still without HTTPS scanning. See: https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/121482/sophos-firewall-https-decrypt-and-scan-faq#mcetoc_1hbv83qnp7

But from my perspective: HTTPS Scanning was not used prior XGS due the performance cut in terms of needed hardware for a good throughput. This is addressed with a XGS Appliance. It is the same like IPS. People disabled it because users complained. 

thanks Toni! I was looking for more details to this topic - too many buzzwords and marketing gaga are still around. The decision makers with the money pocket say: hey, we have state of the art protection. But indeed 4000 users are surfing more or less unprotected. TLS decryption is disabled.

I also think that you may rise the protection level without decryption at least a little bit. But the story is DPI with TLS - We will evaluate and try to consider it as well. It has to work, that is the point, and the web proxy approach was not so good at all.