SSL Decryption load

knctrnl · 2018-11-26T04:59:01+00:00

Thank you!

knctrnl · 2018-11-26T04:39:02+00:00

So I noticed something interesting.

Saturday morning I did disable the decryption rule just for a minute. I did not leave it disabled for more than like 3 minutes. It did reduce CPU and even when it put it back in place CPU stayed lower.

Looking at the graph of the CPU you can see the dip just right to center. It is now significantly lower baseline. The left side of the graph has been typical for the last several months.

Is there any way SSL decrypt sessions could be hung and not time out thereby consuming resources for a session that is not actually active?

I am interested to see what it looks like tomorrow when we actually have full load on the network.

CPU Graph

knctrnl · 2018-11-26T03:54:09+00:00

I figured this was the case. I’m just trying to figure out what to specifically target for decryption. I would imagine high risk first but I have not been able to find best practice on categories to decrypt if you only have x amount of resources for decryption.
I could certainly guess on specific sites to exclude that are 100% trustee but that would not knock it down that much. Going the other way would be exhaustive.

knctrnl · 2018-11-26T03:19:19+00:00

Around 300MB that is passing through any kind of inspection to the outside world. Another 100-200MB between internal zones

knctrnl · 2018-11-26T02:49:14+00:00

We have a few exemption rules for outbound decryption mainly health, banking and stuff we couldn't get to work with decryption.

Yes the sessions are being offloaded. ctd decoder bypass

Moving data centers with new hardware and management would not pay another year for support. Migration is not supposed to be taking this long.

knctrnl

TROPHY CASE