Can i see the encrypted traffic trought the firewall?

[MuggsyO]

Hi Everybody

I tried to know if its possible to see the encrypted traffic, on the Juniper ISG 2000?

If it possible how can i see it?

[Gavrilo]

If you mean can you see it as decypted traffic - No (Thats why it is encrypted )

If you mean can you see it as a stream of encrypted traffic - Yes (Thats what hackers/crackers try to break )

[WL]

Actually for the ISG platform, you may not even be able to see the encrypted traffic itself as this is handled in hardware. You will not be able to see even in the debugs.

[Gavrilo]

Good point WL

[fharoon]

Even if you are able to see the traffic it will be cipher-text, I wonder why you require this? Is it a POC for a customer?

Regards

Farrukh Haroon

[Cesar]

MuggsyO,

If the encrypted traffic is terminated on the ISG-2000, you can disable the security device from creating a hardware session for a specific traffic via CLI "set no-hw-sess" under policy for troubleshooting purposes. This is supported since ScreenOS 6.1

In addition to that, you can use flow and snoop filters on tunnel traffic since ScreenOS 6.2

Hope this helps.

Cesar

Message Edited by Cesar on 03-12-2009 10:40 AM

[Screenie]

Hi Cesar,

I thought you could also force transit traffic to go over the CPU and debug it, not only terminated traffic?

[Cesar]

Screenie,

You are right, you can also send pass though traffic to CPU via  "set no-hw-sess" but the box will not decrypt encrypted pass-though traffic.

Cesar

[Screenie]

Thanks fot your answer Cesar. Of course you can't decrypt the traffic when it's transit. I just wanted to make sure I didn't have it wrong on the debug feature on ISG's. Thanks again.