The proxy-based SSL decryption feature requires the proxy-based SSL licenses to be assigned to specific Sensors. Configuration updates like signature set and policy updates are enabled only when a valid license is assigned to the Sensors. The license is provided as a .zip or .jar file, which is supported by the Manager. The license procured contains the number of Sensors on which the inbound or outbound SSL decryption can be enabled.
Note
To obtain a demo license for proxy-based SSL decryption, contact MB Licensing. An email containing the license will be sent from MB Licensing.
License requirements for proxy-based SSL decryption
Model | System license | SSL license | Virtual license |
|---|---|---|---|
NS9600 (standalone and stack), NS7600, and NS3600 Sensors | Requires a separate system license for each throughput per device. | Requires one SSL license per device, regardless of throughput. | NA |
NS9500 (standalone) and NS7500 Sensors | Requires a separate system license for each throughput per device. | Requires an SSL license matching the capacity of system license | NA |
IPS-VM5000-SSL, IPS-VM600-SSL, and IPS-VM600-VSS-SSL Sensors | NA | NA | Requires one or more SSL-enabled virtual Sensor licenses (IPS-VM1000-SSL-CLD-SUB) depending on the Sensor or cluster capacity. Example:
|
To procure a valid license for outbound proxy-based SSL decryption and upload it in the Manager, refer to the following SKUs:
Sensor Model | SKUs |
|---|---|
NS9600 (Standalone and Stack) | SSL9600ECE-AT |
NS9500 (Standalone) with 30 Gbps | SSL9530ECE-AT |
NS9500 (Standalone) with 20 Gbps | SSL9520ECE-AT |
NS9500 (Standalone) with 10 Gbps | SSL9510ECE-AT |
NS9200 | OSLNS92ECE-AT |
NS9100 | OSLNS91ECE-AT |
NS7600 | SSL7600ECE-AT |
NS7500 with 7.5 Gbps | SSL75075ECE-AT |
NS7500 with 5 Gbps | SSL7505ECE-AT |
NS7500 with 3 Gbps | SSL7503ECE-AT |
NS7300 | OSLNS73ECE-AT |
NS7200 | OSLNS72ECE-AT |
NS3600 | SSL3600ECE-AT |
VM600-SSL (ESX and KVM) | SSLVC3ECE-AB |
VM600-VSS-SSL (AWS, Azure and GCP) | SSLVC3ECE-AB |
VM5000-SSL (ESX and KVM) | SSLVC3ECE-AB |
To procure a valid license for inbound proxy-based SSL decryption and upload it in the Manager, refer to the following SKUs:
Sensor Model | SKUs |
|---|---|
NS9600 (Standalone and Stack) | SSL9600ECE-AT |
NS9500 (Standalone) with 30 Gbps | SSL9530ECE-AT |
NS9500 (Standalone) with 20 Gbps | SSL9520ECE-AT |
NS9500 (Standalone) with 10 Gbps | SSL9510ECE-AT |
NS7600 | SSL7600ECE-AT |
NS7500 with 7.5 Gbps | SSL75075ECE-AT |
NS7500 with 5 Gbps | SSL7505ECE-AT |
NS7500 with 3 Gbps | SSL7503ECE-AT |
NS3600 | SSL3600ECE-AT |
VM600-SSL | SSLVC3ECE-AB |
VM600-VSS-SSL | SSLVC3ECE-AB |
VM5000-SSL | SSLVC3ECE-AB |