Describes SSL Proxy traffic handling before and after HTTP CONNECT support in AppQoE.
Describes how SSL Proxy and DRE handle HTTP CONNECT traffic with and without HTTP CONNECT handling support.
SSL Proxy traffic without HTTP CONNECT
In Cisco IOS XE Catalyst SD-WAN Release 17.x releases, without the decryption of data, DRE fails to observe repeating patterns in a flow and the DRE compression is not effective. And hence, bypassing the DRE for the flow is mandatory or the data flowing to the DRE should be in clear text. When an HTTP CONNECT request is placed, the SSL Proxy doesn't decrypt the HTTP CONNECT SSL traffic, which results in the encrypted traffic flowing to the DRE, that fails to optimize the traffic.
SSL Proxy traffic with HTTP CONNECT
Starting from Cisco IOS XE Catalyst SD-WAN Release 17.9.1a, HTTP CONNECT handling in AppQoE enables the SSL Proxy to decrypt and send clear text data to the DRE for further optimizing.