close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

English

ssl-inspection

date_range 20-Nov-23

arrow_backward

arrow_forward

Syntax

content_copy zoom_out_map
ssl-inspection {
    cache-prune-chunk-size number;
    key-protection;
    maximum-cache-size number;
    session-id-cache-timeout seconds;
    sessions number;
}

Hierarchy Level

content_copy zoom_out_map
[edit security idp sensor-configuration]

Description

Inspect HTTP traffic encrypted in SSL protocol. SSL inspection is disabled by default. It is enabled if you configure SSL inspection.

With the Intrusion Detection and Prevention (IDP) Secure Sockets Layer (SSL) decryption feature, SRX Series Firewalls load configured RSA private keys to memory and use them to establish SSL session keys to decrypt data. IDP is required to decrypt the RSA keys and to check the integrity before performing normal encryption or decryption operations using the keys.

Options

The remaining statements are explained separately. See CLI Explorer.

cache-prune-chunk-size	Number of cache entries to delete when pruning SSL session ID cache. Syntax: `cache-prune-chunk-size`—Number of cache entries to delete when pruning SSL session ID cache. Range: 1 through 100,000 Default: 100
key-protection	Enabling key protection provides improved security. When key protection is enabled, persistent keys are encrypted when not in use. Enabling or disabling of this option requires rebooting the device. Enable secure key handling. This option is off by default.
maximum-cache-size	Maximum SSL session ID cache size. Syntax: `maximum-cache-size`—Maximum number of SSL session ID cache size. Range: 1 through 5,000,000 sessions Default: 100,000
session-id-cache-timeout	Sets the timeout value for an IDP session ID cache (range: 1 through 7200 seconds). Syntax: `maximum-cache-size`—Maximum number of SSL session ID cache size.
sessions	Maximum number of SSL sessions for inspection. This limit is per Services Processing Unit (SPU). Syntax: `number`—Number of SSL session to inspect. Range: 1 through 100,000 Default: 10,000

Required Privilege Level

security—To view this statement in the configuration.

security-control—To add this statement to the configuration.

Release Information

Statements introduced in Junos OS Release 9.3.

Options cache-prune-chunk-size and maximum-cache-size introduced in Junos OS Release 10.2.

Change History Table

Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.

Release

Description

15.1X49-D100

Starting from 15.1X49, the IDP SSL Inspection feature is deprecated. Juniper recommends use of SSL Proxy feature.

arrow_backward PREVIOUS ssl-encryption

NEXT arrow_forward ssl-proxy (Application Services)

Junos CLI Reference

ON THIS PAGE

ssl-inspection

Syntax

Hierarchy Level

Description

Options

Required Privilege Level

Release Information

Change History Table

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry