Hello, everyone, and thank you for watching. My name is Mohammed Zamzam, a customer success specialist at Cisco. At this success capsule video, we are diving deep into a feature that completely changes the game intelligent decryption bypass.00:07Over the next few minutes we're going to step away from traditional resource heavy decrypt everything strategies. Instead, I'll show you how to dynamically fast track trusted traffic and bypass deep packet inspection safely.00:22This lets us save massive firewall CPU cycles, all without compromising your organization's overall security posture. Let's get started. To break down how we deploy this efficiently, we've mapped out today's session into five quick modules. We'll start with the modern decryption dilemma to look.00:37That why classic decrypt everything approaches?00:57Simply don't scale anymore. Next, we'll dive into the architectural foundations to see the core engines driving this logic. From there, we'll build our traffic triage framework so you can safely segment sensitive, fragile, and high bandwidth data. We'll verify our active.01:01Prerequisites. And finally, we'll tie it all together with a live demo. Let's jump straight into module one. Look around any enterprise network today. Over 95 % of all web traffic is completely encrypted. While that's fantastic for user privacy.01:22It hands us a massive headache on the security side. We're essentially flying blind against a huge chunk of potential threats. This hits us with a classic engineering dilemma. If we try to decrypt everything to inspect it, we end up absolutely crippling our firewall performance and hitting serious.01:39Compliance walls with user privacy.01:59But if we just turn a blind eye and don't decrypt, well, we're practically rolling out the red carpet for hidden malware, it's a lose loose situation. So how do we fix it? We get smart with intelligent decryption bypass. Think of it like a high speed data sorter.02:02Instead of a blanket policy, the firewall dynamically splits the traffic. Trusted, low risk or privacy sensitive data takes the intelligent bypass fast track. It gets offloaded instantly, meanwhile suspicious or unknown traffic is routed straight to targeted decryption for deep.02:21Security checks by decrypting only what is absolutely necessary.02:41We strike the perfect balance, maxing out firewall throughput, respecting data privacy, and keeping the network locked down tight. So how do we actually execute an intelligent bypass without accidentally letting malware slip through?02:46We need dual layered deterministic intelligence. That's where cisco's encrypted visibility engine Eve and Talos intelligence come in. The moment an encrypted packet hits the firewall, it's split into two concurrent analysis tracks. Eve analyzes the initiating process.03:02Without decrypting a single byte, it identify the exact client application generating the traffic. Simultaneously, Talos analyzes the destination URL reputation to ensure the destination server is clean.03:22To earn a fast track bypass, the traffic must get a low risk verdict from both sides. If they both clear the bar, the packet bypasses the decryption engine entirely, saving massive firewall overhead, but if either engine flags a risk.03:37Or even an unknown status, the bypass is denied. The traffic is instantly rerouted down the red path straight to the decryption engine for full inspection. Traditionally, if you wanted to know what was hiding inside encrypted traffic, you had to crack the lock and decrypt the.03:55Payload, which completely torches firewall performance.04:15Cisco's Eve completely flips the script. Instead of opening the payload, Eve uses advanced machine learning models to analyze only the outer packet fields and network context. Eve doesn't just guess, it returns a high confidence verdict.04:19In this example, it identifies the exact initiating process as Firefox browser and spots the OS as windows ten with a 99 point 94 % confidence score. From there, Eve generates a client threat score from very low to very high. You get deep policy.04:36Great visibility.04:56Without breaking encryption or taking a performance hit. If you want to dig deeper on this, definitely check out the Eve success capsules for more information. Now let's talk about the destination.04:58We can't bypass decryption without absolute confidence in where that traffic is heading. That's where Cisco Talos comes in, acting as our global radar, tracking and analyzing millions of domains in real time.05:18Talos grades reputations from level one untrusted up to level five trusted while a neutral or ferrable rating might pass a standard firewall rule remember we are talking about bypassing decryption entirely. The margin for error here is zero. That's why our bypass.05:34This threshold is locked strictly onto level five, trusted. By anchoring our policy to the highest tier of Talos threat intelligence, we capture massive performance gains.05:54Without breaking our security posture. Now, once we have Eve and Talos scoring our traffic, we need to apply that intelligence at scale. In an enterprise network, you can't treat all traffic.06:07The same.06:27To maximize efficiency, we segment traffic requiring special handling into three distinct strategic pillars. 1st is the vault. This is all about privacy and compliance. If you have strict regulations like hyper or PCI DSS.06:28You absolutely do not want to be decrypting your user's personal data, doing so is a massive liability. With Cisco's architecture, you get a single click bypass for these highly sensitive categories. The firewall identifies them instantly, pulls them out of the decryption queue next.06:47We have the fragile. This is our business continuity pillar. Weave those frustrating apps that completely break 2nd and inline firewall tries to intercept the traffic. The connection drops, users complain, and operations grind to a halt.07:08The triage board safely detects these undecryptable apps and intelligently routes around them, keeping your critical business connections alive and stable. Finally, we have the heavy. These are our bandwidth savers.07:25Let's be honest. Decrypting high loom low risk traffic like streaming a background music or four K training videos is a massive waste of processing power. By offloading these from the decryption engine, we instantly recover valuable firewall CPU cycles.07:42To focus its heavy lifting power on the traffic that actually poses a threat. By categorizing your traffic, you aren't just protecting user privacy and preventing broken connections, you're drastically optimizing your firewalls throughput. Now, how do we actually turn.08:01This thing on in production. Activation sequence to ensure your infrastructure is ready. 1st up, check your code.08:21Both your FMC and FTD need to be running release 7.7 or later. This capability is exclusive to this architecture. Second, make sure your boxes are licensed properly. You need both active threat IPS and URL licenses spun up.08:29Remember, we are relying on that dual engine Eve and Talos analysis we just talked about.08:49So those subscriptions have to be active to power the back end logic. Finally, the actual toggle. This doesn't just happen magically. You need to go into the advanced settings of your access control policy and explicitly enable the encrypted visibility engine.08:56Eve. Once that policy is deployed, your firewall is officially primed to handle intelligent bypass. Now the best part for us as security administrators, it is incredibly simple to spin up.09:14Let's jump right into the FMC dashboard so I can show you exactly how to configure the policy, deploy and monitor it. Let's starting on the FMC summary dashboard, let's build our decryption policy. Move your cursor to the left side bar menu. Hover over policies.09:29And select decryption from the slide out menu. Now let's launching the wizard. We'll give it a name demo and we'll focus on outbound connections. This is a common use case where organizations wish to protect users.09:48As they access resources over the internet, for outbound decryption, we need to use or generate an internal certificate authority which is used to man in the middle of our outbound connections. FMC can also generate its own self signed CA.10:04We're now able to configure blocking for old deprecated encryption protocols. Many organizations wish to prevent the use of protocols like SSL three, TLS 1.2 and TLS 1.1, given their known vulnerabilities. We can also block connections that have certificate issues such as being expired or having an invalid.10:22Signature, next we come to our decryption exclusion options.10:42The 1st option allows us to bypass decryption for sensitive URL categories. Most organizations do not desire to decrypt privacy sensitive sites such as ones that are related to health care or personal finance. As you can see, we have pre populated this setting with bypasses for.10:46Health and medicine finance and online trading. You can also add additional URL categories if you desire.11:06I like to add the categories of streaming audio and video as they are low risk bandwidth intensive traffic. Further down the page, we have an option to bypass decryption for undecryptable applications. This contains a list of business relevant sites that are known to use techniques such as client.11:14Certificate authentication.11:34Or certificate pinning, attempting to decrypt these sites effectively breaks them. So this checkbox bypasses decryption for them entirely. At the bottom of the page, we see our new intelligent decryption bypass feature. As mentioned earlier, this feature leverages the power of our encrypted visibility engine to assess the client.11:36Process and leverages Talos server reputation to assess the server being connected to. If both client and server are deemed very low risk, we will not attempt to decrypt the connection. We can see a number of auto generated rules which have been created by the decryption wizard. At the top, we have rules which are blocking invalid server.11:56Certificates in older protocol versions. We also see an auto rule which bypasses decryption for low risk connections.12:16As part of the intelligent decryption bypass feature. Next is a rule that bypasses decryption for sensitive URL categories like finance and health. And in our case, we're also using it to bypass decryption for streaming audio and video. Finally, we're bypassing decryption for all of those undecrypted.12:24Business applications, after all of these bypasses have been applied?12:45We can then decrypt all other traffic originating from our corporate network user's range. Our new decryption wizard gives you a strong starting point for your decryption. Once the rule table builds, we need to bind this decryption policy to our access control policy.12:49Click the decryption tab at the top, select your new demo policy from the dropdown and apply the changes. With the policy deployed, let's verify that the engine is actually working.13:16Navigate to events and logs on the left menu and select unified events. To filter our view, we'll open the search field, select application protocol, and search for HTTPS and QIC traffic. Click apply. Look closely at the.13:41The Connection event log columns on the far right for our secure low risk sessions, the engine returns an Eve threat confidence of very low and a TLS actual action of do not decrypt. The firewall successfully identified the process and dynamically offloaded the connection at line rate.13:58You've officially deployed intelligent decryption bypass. Happy decrypting. Now, that concludes our session. Thank you for your time, and I am confident these insights will immediately elevate your workflow.14:18
