SSL/TLS Inspection Rules: Decryption profile required when action is "Do not decrypt"?

The DPI engine has the ability to enforce many TLS and Certificate checks even if it is not decrypting.

For example, you could enforce that a connection must be TLS 1.2 or better, but also do not decrypt.

This is an added feature of the DPI mode that is not available in the traditional web proxy, which can only enforce if it is decrypting.

Appreciate the explanation. While it makes sense that the DPI engine is still able to perform other functions, it just seems weird you need to specify a "decryption profile", if it's not actually decrypting.

Hi Shred,

The question arises why are you using SSL/TLS (DPI) if you are not decrypting the packets through that rule?

Ian

Hi Shred,

The question arises why are you using SSL/TLS (DPI) if you are not decrypting the packets through that rule?

Ian

I have a rule I use to temporarily bypass decrypting traffic. Regardless, the use case doesn't matter. There's an option to select the action "Do not decrypt" so I'm assuming this is an intentional/intended functionality of SSL/TLS Inspection Rules. Michael Dunn's post explains my original question. All I'm suggesting is how it's labeled isn't the most clear/logical. It's minor though so I'm not overly concerned.