Array Networks ASI 9900

Say Goodbye to Encryption Blind Spots

Array SSL intercept provides enterprises with visibility into encrypted traffic entering, leaving, and traversing their network. Deployed in conjunction with solutions such as next-generation firewalls, network monitoring, and intrusion detection and prevention, SSL intercept offloads compute-intensive decryption and re-encryption tasks to allow essential security functions to operate at scale. SSLi is an ideal solution for optimizing both security and infrastructure efficiency.

Every ASI SSL intercept solution supports Layer-2 and Layer-3 deployment modes, inline and out-of-band inspection, service chaining and the ability classify Web traffic to ensure regulated data is handled in accordance with compliance policies. Available as physical or virtual appliances, the ASI Series is ideal for businesses needing to protect user privacy while gaining scalable visibility into the increasing number of advanced threats hiding within SSL traffic.

High Performance, Best-in-Class Ciphers

With dedicated SSL/TLS acceleration hardware of Array’s SSLi solution on APV and AVX appliance for high throughput of RSA 2048-bit and 4096-bit key sizes as well as ECC ciphers, Array SSLi delivers high performance while supporting multiple cipher suites, including DHE and ECDHE, for Perfect Forward Secrecy (PFS).

Multiple Deployment Modes

As per the customer environment, Array SSLi solution can be deployed in Layer-2 or Layer-3 mode, on single device or multiple as required. Layer-2 mode is called the bridge mode. With an L2 bridge configuration, the APV appliance function as an L2 device to bridge SSL traffic, allocate it to the upper layer within the APV appliance for decryption and then forward the decrypted traffic to the security device(s) for inspection.

Layer-3 mode is called the routing mode. In this configuration, the APV appliance working in L3 mode forwards all the packet that is not destined for any of its IP addresses by looking up in its routing table. Packets that are left and are not meant for any of its MAC addresses are forwarded by looking up its MAC address table. When the APV appliance works in L3 mode, it can cooperate with two or more security devices working in L2 or L3 mode to implement SSL interception.

For inbound, known domains, encrypted network packets can be intercepted and decrypted by deploying the server private key on SSLi. On the other hand, for outbound SSL traffic originating from clients is sent out to the internet or cloud hosted infrastructure which in turn proves that APV appliance can function as a forward or reverse proxy.

Decryption across Multiple TCP Ports

If the application is using SSL/TLS, Array SSLi decrypts application traffic across all TCPS ports using Deep Packet Inspection (DPI). Decryption for protocols such as SMTPS and POP3S are also supported.

SPAN Port Support

The Array SSLi SPAN Port feature integrated filter lists to filter the traffic that needs to be captured. With the help of filter lists, the system is configured to capture traffic with specific source IPs, source ports, destination IPs and destination ports. Furthermore, it allows the definition of packets to be captured that is flowing in the inbound, outbound or both (bidirectional).

Complete Proxy Architecture

Array SSLi acts as a proxy that can adjust the cipher suite selected for encryption. It can re-negotiate to a different cipher suite of a similar strength, which makes the solution future-proof against new ciphers or TLS versions that might occur in the network without notice. It also ensures the traffic is encrypted using the most secure ciphers, discarding the use of compromised ciphers.

Centralized Management and Analytics

Centralized management and analytics can be used for configuration, monitoring and reporting. Array SSLi includes industry standard CLIs, RESTful APIs and System Logs that can be easily integrated with thirdparty or custom management consoles, includes SSL/TLS keys and certificates management. It helps the enterprises and cloud service providers efficiently manages and monitor multiple Array Networks products among other applications/devices from a central point. The centralized management provides an easy way to lay down administrative privileges to different types of administrators, streamlines and speeds-up configuration management of multiple local or geographically distributed appliances.

Traffic Management

Array SSLi includes APV Series ADC traffic management functions that can manage nonencrypted traffic as well, with options available such as, block/drop and redirect to assure appropriate handling of the traffic.

Load Balancing of Multiple Security Devices

Array’s industry-leading ADC load balancing capabilities can be utilized with the SSLi solution to help improve the availability and performance of the security devices. The system (either one or two APV appliances) then send captured packets to multiple security devices, either of the same or different types.

If the security devices are of the same type, the system can be configured to send the captured packets to the security devices in a load balancing manner based on the hash value of the packets’ source IP and destination IP addresses.

SSLi - URL Categorization

Array’s optional SSLi URL classification uses Webroot BrightCloud to categorize URLs (such as financial or health web sites) across 82 categories.

Thereafter the traffic is selectively bypassed or decrypted depending on the compliance standards and risk factors. With this functionality enabled, the APV appliance determines the category of a given website via the local cache, the local database or an online connection to the Webroot server.

Privacy and Compliance Initiatives

The SSL Intercept serves as an effective policy enforcement point to control SSL traffic throughout the enterprise. It reduces risks posed by encrypted traffic, while maintaining compliance with relevant privacy policies and regulatory requirements. Using URL Classifications, organizations can easily create granular policies to selectively decrypt traffic to meet their business needs (Example: “Do not decrypt financial or banking traffic going out of the business”)