1

I’m preparing to deploy DPI-SSL on our sonicwall; we tried deploying it years ago with terrible results. The product was not as robust combined with poor planning created far to many issues and we had to revert back. Getting ready to attempt it again and wanted to see who in the community has deployed it and if you can offer tips and suggestions to ease the pain of deploying the solution. I’ve already got the cert installed on all workstations through GPO, I did have a few questions

  • My workstation DHCP range is 100-199, if i want to start with half of that range, under objects, do i set “Exclude” to NONE and INCLUDE to an address object 100-150? (I guess i don’t understand how exclude and include work when exclude is set to none?
  • Should I start with IPS, GAV, GAS, AppFirewall, and CF? Or is it better to start with less client inspection and then turn additional ones on?
  • I’ve attempted to add many known domains to the CN exclusion list, can anyone share their list of custom sites?
  • Will sites that use certificate pinning cause an issue? What if they are CN excluded, still issues?

Any other gotchas i should be on the lookout for?

2 Spice ups
2

It did used to break everything, now it is very good. video below walks you thru it. pretty easy now actually. the hardest part is the cert via gpo.

3

I don’t know what industry and or country you are in but be aware of laws/regulations on cracking open SSL communications.

Assuming you are US, things like Medical, Financial, HR are protected. HIPAA! Medical even a person logging into their insurance to print an ID card is a no no.

4

Also be aware doing SSL DPI IPS, is going to drop your throughput. As this is intensive for your appliance. So depending on what your internet pipe is could be reduced by 75%.

What sonicwall device do you have? What speed connection?

5

What is your SonicWall device? What is the maximum number of DPI-SSL connections?
Will Android devices use DPI-SSL?
I have problems with Android 7. Earlier versions work correctly.
Android devices (basically all versions starting with 5.0) use a lot of connections per device (even hundreds).
There are no problems with Windows systems.

6

I find that I have to do a lot of exclusions for apps and mobile devices. Web browsers work fine and services that use certificate pinning like Dropbox work once excluded. Sometimes sites need to be reloaded if the firewall hasn’t cached the domain name yet. Overall it works pretty well and CFS category based exclusions help a lot to exclude sensitive sites.