DPI-SSL Overview

Deep Packet Inspection of Secure Socket Layer (DPI-SSL) extends SonicWall’s Deep Packet Inspection technology to allow for the inspection of encrypted HTTPS traffic and other SSL-based traffic. The SSL traffic is decrypted transparently, scanned for threats and then re-encrypted and sent along to its destination if no threats or vulnerabilities are found.

DPI-SSL provides additional security, application control, and data leakage prevention for analyzing encrypted HTTPS and other SSL-based traffic. DPI-SSL supports:

•
Transport Layer Security (TLS) Handshake Protocol 1.2 and earlier versions – Starting with SonicOS 5.9.1.6, the TLS 1.2 communication protocol is supported during SSL inspection/decryption between the firewall and the server in DPI-SSL deployments (previously, TLS 1.2 was only supported between client and firewall). SonicOS also supports TLS 1.2 in other areas as well.
•
SHA-256 – Starting with SonicOS 5.9.1.6, all re-signed server certificates are signed with the SHA-256 hash algorithm.

The following security services and features are capable of utilizing DPI-SSL:

•
Gateway Anti-Virus
•
Gateway Anti-Spyware
•
Intrusion Prevention
•
Content Filtering
•
Application Firewall
•
Packet Capture
•
Packet Mirror

DPI-SSL has two main deployment scenarios:

•
Client DPI-SSL: Used to inspect HTTPS traffic when clients on the SonicWall security appliance’s LAN access content located on the WAN.
•
Server DPI-SSL: Used to inspect HTTPS traffic when remote clients connect over the WAN to access content located on the SonicWall security appliance’s LAN.