300-415 Question 230
Select 2A company has deployed Cisco SD-WAN and wants to inspect encrypted traffic to ensure compliance with security policies. They plan to configure SSL/TLS proxy on their SD-WAN edge devices. Which of the following actions are required to enable SSL/TLS proxy functionality within the SD-WAN environment?
- A
Generate and install an enterprise root certificate on the SD-WAN edge devices
- B
Enable DPI (Deep Packet Inspection) on the SD-WAN edge devices
- C
Configure a policy to intercept HTTPS traffic and specify decryption rules
- D
Enable automatic key exchange between SD-WAN edge devices and end-user devices
- E
Deploy a certificate authority (CA) within the SD-WAN controller to issue certificates for SSL/TLS proxy
Show answer and explanation
Correct answers: A, C
Explanation
To enable SSL/TLS proxy in a Cisco SD-WAN environment, it is necessary to generate and install a trusted enterprise root certificate on the SD-WAN edge devices. Additionally, policies must be configured to intercept HTTPS traffic and define decryption rules. These steps ensure that encrypted traffic can be decrypted, inspected, and re-encrypted securely while maintaining compliance with security policies.
- A. Correct.
Correct: To perform SSL/TLS proxy, SD-WAN edge devices need a trusted enterprise root certificate to intercept and decrypt encrypted traffic.
- B. Incorrect.
Incorrect: While DPI is used for application recognition, it is not directly related to SSL/TLS proxy functionality. SSL/TLS proxy focuses on decrypting and inspecting encrypted traffic.
- C. Correct.
Correct: A policy must be configured to intercept HTTPS traffic and specify how SSL/TLS decryption and inspection will be applied in the SD-WAN environment.
- D. Incorrect.
Incorrect: Automatic key exchange is not a feature of SSL/TLS proxy configuration. The decryption process relies on certificates and policies rather than key exchanges.
- E. Incorrect.
Incorrect: A certificate authority (CA) is not deployed within the SD-WAN controller. Instead, a trusted enterprise CA or third-party CA is used to issue the necessary certificates.