Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is is possible for a AIP module within a Cisco 5510 ASA to decrypt and inspect SSL traffic?

I have asked my local vendor (who placed the devices of which I speak) and they say that the AIP module is incapable of reviewing encrypted content. I work with web application firewalls fairly commonly thus familiar with the ability to install a web certificate on a appliance to allow it to see into the SSL traffic. Is that impossible on an ASA w/ a IPS module?

share|improve this question
up vote 1 down vote accepted

Correct. The ASA does not perform SSL termination (beyond that required for WebVPN and AnyConnect VPN), so it is unable to provide a decrypted data stream for the AIP to inspect. You would need to position something else in front of the ASA that can perform SSL termination, such as a Web application firewall, as you mentioned. Some load-balancing products (e.g. Cisco CSM-SSL) can do this as well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.