NimbostratusGreat discussion on outbound SSL visibility. You forgot one important option; forwarding of traffic to a cloud-based filter that does everything the devices you mentioned does, in a single pass, and decrypts SSL once to do it. F5 LTM can simply build a GRE tunnel to that cloud service, and without the cost, complexity, and performance hit of distributing across multiple security appliances, or the addition of the SWG module, you have a.) SSL Visibility (even for DLP), b.) Resiliency of the cloud, and c.) Scalability of a cloud security platform that can grow in SSL performance for a reasonable recurring cost, much like you pay on all those security devices sitting in your data center that you backhaul all the traffic to in order to achieve this centralized processing of outbound SSL traffic. Nothing like combining the leader in inbound traffic management and security, with the leader in outbound traffic security in the cloud.
Employee
AdminEmployeeThanks! Do we still need an LTM module as the SSL Offloader? Assuming we do not have an SSL offload device currently?
Admini believe the LTM+SWG licensing combo would be required, yes, but an SE could confirm for you.
NimbostratusGreat vid. Very digestible way of explaining it. Is there a with paper on this kind of set up? Or could you recommend reading material?
Adminthere will be details coming, and I can't share exactly why, but my licensing information above is probably inaccurate. Hate to be cryptic, but can't give the goods just yet.
NimbostratusNo problem at all. In fact, mystery answer is probably more fun than actual answer...so well played.
NimbostratusSo it is 1 month later. Post Agility. Any update on the licensing information discussed above?
AltostratusFrom my knowledge you will need the SSL forward proxy license, which is not included in the SWG license as far as i know. You can integrate SWG into the solution, but this is an option. The SSLi solution can also be run without SWG.