Networking

Inside Next-Gen Firewall SSL/TLS Inspection

Network Design diagram · made in Skemio

Next-Gen Firewall SSL inspection workflow showing client connecting to internal switch, firewall decrypting payload for threat scanning, and re-encrypting to web.
Next-Gen Firewall SSL inspection workflow showing client connecting to internal switch, firewall decrypting payload for threat scanning, and re-encrypting to web.
Open it in SkemioMake your own

What it shows

  • Acts as a transparent proxy by terminating client and server handshakes.
  • Requires pushing an enterprise root CA certificate to all endpoints.
  • Bypasses privacy-sensitive traffic like banking and healthcare via SNI.

The takeaway

Without deep packet SSL inspection, modern perimeter firewalls are virtually blind.

More network design diagrams