Cisco Cisco Firepower Management Center 4000

To base identification of encrypted traffic only on server traffic, you can enable the 

 option; that is, server side data is trusted to indicate that the traffic is encrypted. The SSL 

preprocessor typically checks both client traffic and the server responses to that traffic to determine if a 
session is encrypted. However, because the system may not mark a transaction as encrypted if it cannot 
detect both sides of a session, you can rely on the SSL server to indicate a session is encrypted. Note that 
when you enable the 

 option you must also enable the 

 option so the system does not continue inspecting traffic in the encrypted session.

You can specify the ports where the preprocessor monitors traffic for encrypted sessions.

If the SSL preprocessor detects non-SSL traffic over the ports specified for SSL monitoring, it tries to 
decode the traffic as SSL traffic, and then flags it as corrupt.

Admin/Intrusion Admin

Select 

The Intrusion Policy page appears.

Click the edit icon (

) next to the policy you want to edit.

If you have unsaved changes in another policy, click 

 to discard those changes and continue. See 

 for information on saving unsaved changes in another 

policy.

The Policy Information page appears.

Click 

 in the navigation panel on the left.

The Advanced Settings page appears.

You have two choices, depending on whether 

 under Application Layer Preprocessors is 

enabled:

If the configuration is enabled, click 

.

If the configuration is disabled, click 

, then click 

.

The SSL Configuration page appears. A message at the bottom of the page identifies the intrusion policy 
layer that contains the configuration. See 

 for more 

information.

Type the ports, separated by commas, where the SSL preprocessor should monitor traffic for encrypted 
sessions. Only ports included in the 

 field will be checked for encrypted traffic.

Click the 

 check box to enable or disable inspection of traffic in a session 

after the session is marked as encrypted. 

Click the 

 check box to enable or disable identification of encrypted traffic based 

only on the client-side traffic.

Optionally, click 

 at the top of the page to display rules associated with 

individual options.

Click 

 to return to the SSH Configuration page.