Add a Policy for SSL Decryption

SSL decryption policies allow you to specify the traffic you want to leave encrypted.

Configuring a SSL decryption policy:

1. Navigate to Policies > SSL Decryption.

2. Click Add Policy. The New SSL Decryption Policy page appears.

3. For Match Criteria, specify the match criteria for the traffic. You must specify at least one match criteria from the Add Criteria dropdown to create a policy. The system applies the ‘AND’ operator among multiple criteria groups (e.g. user, domain, and category), and the ‘OR’ operator among multiple match criteria values (e.g. Category 1, Category 2, Category 3). The following table lists the match criteria options.

   Criteria	Options
   Source Network Location	Search and add a source network location (select all that apply) and match against User IP and Source IP addresses. Click +New to add a new network location. See Add New Network Location for SSL Decryption for details. Note By default, you can only configure one Source IP type per SSL decryption policy. To configure both source IP types together in one policy, the “RBAC V2” and “Source IP Egress AND Condition” features must be enabled for your tenant. Contact Support to enable these features.
   Match Against Field	User IP Address – This is the user’s internal / private IP address (RFC 1918). Egress Source IP Address – This is the user’s external NAT (Public) IP address. Traffic that runs through the Netskope gateway, including both the User IP and Egress Source IP addresses are viewable by the system. The distinction is helpful so admins can make selective decisions for internal hosts (user IPs) versus all hosts in a given network (egress IPs).
   Destination Network Location	Search and add a destination network location, select all that apply. Click +New to add a new network location. See Add New Network Location for SSL Decryption for details.
   Category	Lists all categories. Netskope supports using regex for the Category match criteria. For more information on supported regex formats, see URL List Best Practices.
   Domains	List domains as comma separated values. Netskope supports domain names based on server name indication (SNI) and not certificate name (CN) or subject alternative name (SAN). Netskope supports using wildcard domains (e.g., *.example.com) for the Domains match criteria, but no other regex characters are supported. Note It is not possible to create a SSL decryption policy based on path information (<your domain>.com/<path>), because the path is inside the encrypted payload.
   Service	Lists all service objects, including Service profiles, which allows for policy creation based on destination ports. Note that SSL decryption policies are only applicable to TCP ports and port ranges.
   User	Lists all users
   User Group	Lists all user groups
   Organizational Unit	Lists all organizational units
   App Suite	List of app suites specified with table shown in the App Suite Details topic. Each app suite name is mapped to a list of defined domains, and the domain list gets updated for new / changes periodically.
   App	Lists apps that are uniquely identifiable based on a single domain name. There are no overlapping domains to apps. You can select one or more predefined or custom apps and custom apps have higher priority over predefined apps.
   Access Method	Lists all applicable access methods.
   OS Family	Lists all device operating system families. Note This match criteria option is only applicable when the Netskope Client is deployed on the device. For example, the access method is Client or Client is used in combination with other access methods.

4. For Action, you can select one of the following options:

   • Do Not Decrypt: Traffic will not go through deep analysis.

   • Decrypt: Traffic will move to deep analysis via the Real-time Protection policies.

5. For Set Policy, enter a Policy Name. Optionally, you can enter a Policy Description.

6. Click Save.

Once you create a policy, you can perform the following actions described in the table below.