Adds a rule to a network policy that decrypts HTTPS traffic based on the specified IPv4 or IPv6 address and mask.
When you configure rules for a network policy on the Network Security appliance, you can control which traffic to decrypt based on the destination IP address, source IP address, or mask. You can configure rules for a specified network port pair or all network port pairs. By default, the Network Security appliance can decrypt HTTPS traffic based on any IP address and mask on all port pairs. You can configure multiple network policy rules with different subnets for your organization.
Important
You must enter each rule separately. You can add up to 512 rules to the network policy. The network policy rules are optional.
For details about how to add a network policy, see the "Configuring SSL Interception" chapter of the Network Security User Guide.
Syntax
policymgr ssl-intercept network ip <IP_address|<prefix>|<any>> interface <port-pair-name> decrypt <no_parameter | match-destination | match-source>
Parameters
<IP_address|<prefix>|<any>
IP source or destination address for the network policy rule. To match any IP address for the network port pair, enter any.
<port-pair-name>
Network port pair designation (A through F) that is configured on the appliance interface. To specify all the network port pairs, enter ALL.
<no_parameter | match-destination | match-source>
Enter the option to match the IP address with the destination or the source IP address. This parameter is optional. If you do not provide either option, the IP address will be matched with both source and destination addresses.
Example
The following example adds a rule to a network policy that decrypts traffic matching the specified based on the IPv4 address:
hostname (config) # policymgr ssl-intercept network ip 11.14.32.0/24 interface B decrypt
The following example adds a rule to a network policy that decrypts traffic matching the specified based on the IPv6 address:
hostname (config) # policymgr ssl-intercept network ip 2002:470:84a7:1720:ae1f:6bff:fe12:3e03/128 interface A decrypt match-source
User role
Admin or Operator
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Network Security: Release 8.2.1. Support to add up to 512 rules to the network policy was added in Release 8.3.2.