@PhilipDAth wrote: No I don't know the performance impact. I'm trying to get myself onto the beta program. Being a close beta I'm not sure, but I asked if I could talk about this in public and was told yes and the documentation is publically posted. I'm generally not a fan of SSL inspection - because it is a lot of work to deploy and breaks things. You need to load a certificate onto the MX (or any device that does TLS inspection), and then load that certificate as a trusted root certificate onto every device sending traffic via that MX. For some mobile devices that is a real pig of a job. You end up creating more VLANs, so you can inspect some types of devices and avoid others because they are too much work - or you create huge bypass/whitelist rules. Then you get sites (like www.google.com) that specifically check that the certificate returned is Google's, and will report a security problem. So you end up telling the browser to ignore this, and the user has worse protection when they are out of your office, or you start whitelisting things all over the place. Then you get issues with new versions of server software offering newer encryption and TLS versions faster than the SSL inspection engine is updated, breaking things. For example, this TLS inspection feature only supports TLSv1.2. So if you went to a web site that only offered TLSv1.3 (not likely at this stage) it would break. With Cisco Firepower you can say only TLS inspect sites with a "rank" below a certain value. Then it ignores high ranking sites like Google, Office 365, etc - and only pays attention to low ranked sites (far more likely to be used for malware). This also relieves a lot of load off the device, as the bulk of your traffic tends to be to high ranking sites (the very defination of high rank). That's a good breakdown, @PhilipDAth As a reseller, I just look forward to it so it checks the box as something competitors currently do, but Meraki does not..
... View more