2016 Symantec Corporation This document may be freely reproduced & distributed whole & intact including this copyright
notice.
13
The SV3800/SV3800B/SV3800B-20 software provides the ability to inspect both
incoming and outgoing SSL/TLS traffic and detects SSL/TLS traffic by deep
packet inspection (DPI) so no matter what port the SSL/TLS traffic is using it will
be detected. Once an SSL/ TLS flow has been detected the
SV3800/SV3800B/SV3800B-20 policy engine determines what to do with the
flow:
•
it can be inspected providing a decrypted version to the attached
appliance(s)
•
it can be cut through, allowing the attached appliance(s) to see the original
encrypted flow
•
it can be blocked such that the flow is terminated and cannot continue.
The policy engine allows policy to be based on a wide range of parameters such
as:
•
the source/destination IP address of the flow
•
the Distinguished Name (DN) of the subject or issuer contained in the
SSL/TLS server certificate sent by the server
•
the cipher suite being used for the flow
This allows for fine grained control over which SSL/TLS traffic is inspected, and,
when the SV3800/SV3800B/SV3800B-20 is deployed in-line, enables fine grained
policy control over what SSL/TLS traffic is allowed in the network.
All SSL/TLS traffic seen by the SV3800/SV3800B/SV3800B-20, whether it is
using approved or non- approved algorithms, will be processed to a degree. At a
minimum the SSL/TLS handshake will be observed in order to collect
information that the policy engine will use to determine how the flow should be
handled. Using the policy rules it is possible to cause the following actions to be
applied to a flow:
•
block the SSL/TLS flow
•
allow the SSL/TLS flow without any inspection
•
allow the SSL/TLS flow with the flow being inspected
The policy engine is aware of the cipher suite that the SSL/TLS flow is using, and
can base its decision on that. So, it is possible to configure policy settings that will
prevent any SSL/TLS flows using non-approved algorithms from being
established through the SV3800 if that is desired. If SSL/TLS flows using non-
approved algorithms are allowed by the policy engine then they should be
considered as being “clear text” due to the use of non-approved algorithms.
2.2 Module Specification
The hardware version numbers in Table 2-2 provides a mapping between the
hardware versions and the appliance types available. All appliance types, for a
given model, have the exact same hardware and firmware, and are exactly the
same from a cryptographic functionality and boundary perspective.
