Breaking SSL security to scan for malware about to enter at the edge of the network is a VERY GOOD thing.  A real SSL inspection service will allow trusted connections to bypass SSL encryption like data traversing to and from banks, or to trusted cloud services like Google Search, but can be selectively implemented on new or unknown services to help protect the user from downloading backdoors and trojans.  It doesn't have to be an on/off service, but how can you call ANY network secure without having some semblance of SSL inspection or deep packet inspection?  You can't.  Don't believe me?  Go to Eicar.org and test the efficacy of your edge security.  Without packet inspection you're not going to be able to stop viruses from entering your network.  If your local AV software is alerting about the download then that's your last line of defense and your security posture is crap. ... View more

Alternatively, if you’re trying to set up a VPN, you might not need to enable FIPS. Instead, you could configure the IPsec policies with a password greater than 14 characters, ensure Authentication is not MD5, set the Diffie-Hellman Group to 14, ensure Phase 2 encryption is not NULL, and configure PFS to be either off or 14.     ... View more