TLS Decryption
Powered by the Gigamon Deep
Observability Pipeline with GigaSMART

Introduction
GigaSMART® TLS/SSL decryption, is a comprehensive solution designed
to provide deep observability into encrypted network traffic. It enables
operation’s teams to have full visibility into encrypted traffic, including TLS 1.3,
on any TCP port or application.
TLS/SSL decryption offers TLS/SSL dashboard that delivers detailed insights intosession performance, network capacity, and traffic decryption. This enables
SecOps and NetOps teams to monitor decryption status, analyze trends, andidentify anomalies in real-time, enhancing security, and compliance.

© 2024 Gigamon. All rights reserved.

1FEATURE BRIEF | TLS DECRYPTIONInternetNGFW

FirewallIPS

ATPWAF

NDR, IDS,SIEM, NPM, APM

Routers

TLS/SSL Decryption

Internal
Network

TPP=Venaﬁ HSM=nShield and Thales Luna
Encrypted Trafﬁc

Decrypted Trafﬁc

Figure 1. Network topology with the Gigamon Deep Observability Pipeline decrypting and sharing plain-text traffic with in-band and out-of-band tools.

Key Features

Key Benefits• Complete visibility into inbound/outbound traffic• No blind spots on the network• Visualize encrypted traffic with TLS/SSL Dashboard• Troubleshoot and monitor issues in encrypted• Automatic TLS/SSL detection on any TCP port
• Decrypt once, feed many tools• Flexible feeds & speeds and interface support(10M–100Gbs)• Full control over tool traffic and content.
• Protect tool performance and scale as needed• Supports all advanced ciphers and TLS 1.3• Supports NAT/PAT L3 explicit tools

traffic easily• Legacy tools can connect to the fabric• Enhanced tool performance• Preserve data privacy and compliance• Maximum session security with latest
cryptographic standards• Optimize protection of North-South andEast-West lateral traffic(for example, firewalls)• Supports TPP and HSM products© 2024 Gigamon. All rights reserved.

2

FEATURE BRIEF | TLS DECRYPTION

Gain Visibility and Control
The increasing volume of encrypted traffic posesa significant security challenge. To effectively
address this challenge, organizations need to gain
comprehensive visibility and control over encrypted
traffic. This can be achieved by decrypting bothinbound and outbound encrypted communications.
However, decryption is a resource-intensive operationthat can significantly impact the performanceof security tools. A study by NSS Labs found that
activating TLS/SSL decryption on eight leading nextgeneration firewalls caused a significant drop in
firewall performance, with reductions reaching up to80 percent2.
The Gigamon Deep Observability Pipeline with
GigaSMART addresses this challenge by offloading
the decryption processing to a dedicated appliance.
This frees up security tools to focus on their primaryfunction of detecting and mitigating threats. As aresult, organizations can gain the visibility they need toprotect their networks without sacrificing performance.
The GigaSMART decryption solution also provides
automatic visibility into encrypted traffic, regardlessof the TCP port or application. This helps organizations
to identify and respond to threats that may be hiddenin encrypted traffic.
With TLS/SSL Dashboard, troubleshooting andmonitoring TLS/SSL health is easy. The dashboard isaccessible through GigaVUE-FM Fabric Health
Analytics and helps organizations visualize encrypted
traffic to assess performance, compliance, and risks
in encrypted traffic. Get granular real-time stats andanalyze URLs, CPU, memory, TLS versions, cipher suites,connection rates, concurrency numbers, and more.
Easily investigate issues with historical data, track
trends and generate reports.

Figure 2. TLS/SSL Dashboard.

© 2024 Gigamon. All rights reserved.

3

FEATURE BRIEF | TLS DECRYPTIONThe Solution

Flex Inline and Decryption

The Gigamon Deep Observability Pipeline, withGigaSMART capabilities, can help you efficiently
offload the decryption processing burden from yoursecurity tools. This frees up your security tools to focus
on their primary function of identifying and mitigating
malware threats.

Using flexible inline maps, you can identify specificflows of traffic using Layer 2 to Layer 4 rules, thendesignate the tools that will inspect the traffic, andspecify the order of traffic to the tools.

With a GigaSMART license, your NetOps, SecOps,
and InfoSec teams can automatically gain enhanced
visibility into encrypted traffic, regardless of the TCP
port or application. This increased visibility helps toprotect your networks from potential data breaches
and concealed malware threats that may be lurking inencrypted network channels.

It’s easy to configure Flex Inline Decryption using
GigaVUE-FM fabric manager with the built-in fabricmaps feature.
Figure 3 shows how GigaSMART engines create adecryption zone within the inline map.
Need to make changes? Simply drag and drop to movetools in and out of the zone as needed.

Gigamon integrates with the Venafi Trust Protection
Platform, Thales Luna HSM, and Entrust nShield HSM tocentralize key management and validation. The VenafiTrust Protection Platform uses the Thales Luna HSM,
and Entrust nShield HSM for private key generation for
TLS/SSL keys and certificates.

Figure 3. G igaVUE-FM Flex Inline and decryption.

© 2024 Gigamon. All rights reserved.

4

FEATURE BRIEF | TLS DECRYPTION

Technical Features
Features

Specifications

Products supported

GigaVUE-HC1
One engine per chassis,
One engine per module

Hardware required

At least the base chassis

Software required

GigaSMART TLS Decrypction license (see GigaSMART data sheet)

TLS/SSL versions supported

SSLv3, TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3

Hardware Security Module (HSM)
supportYes (Entrust nShield, Thales Luna HSM)

TPP (Trust Protection Platform) support

Yes (Venafi)

IPv6 support (Passive and Inline
TLS/SSL Decryption)

Yes

Interfaces supported

1, 10, and 40Gbps# of categories supported forselective decryption

86

Physical inline bypass options

1 and 10Gbps

FIPS 140-2 certification

Level 2

Split proxy function

Yes

TLS/SSL Dashboard support

Yes1

GigaVUE-HCT
One engine per module

GigaVUE-HC1-Plus
One engine per chassis,
One engine per module

GigaVUE-HC3
Two engines per module

1, 10, 25, 40, and 100Gbps

1, 10, 25, 40, and 100Gbps

10, 40, and 100Gbps

1 and 10Gbps

1 and 10Gbps

40 and 100Gbps

Note: Passive TLS Decryption is also supported by GigaVUE Cloud Suite™. Performance characteristics for GigaVUE Cloud Suite will be provided
in future updates.	Over 96 percent of Google traffic is encrypted. 3
Up to 40 percent of large enterprises have already instituted TLS 1.3. 4	In 2022, more than 85 percent of attacks took place in encrypted traffic, with 90 percent of thosethreats involving malware. 5© 2024 Gigamon. All rights reserved.

5FEATURE BRIEF | TLS DECRYPTIONGigaSMART TLS Performance Specifications
Values reflect the maximum available number of latest generation GigaSMART modules per chassis.

InlineModel

Maximum
Connections/Sec.

Maximum
Throughput (Gbps)

Maximum
Concurrent Connections

GigaVUE-HC3

105,00058

1,600,000

GigaVUE-HC1-Plus

39,00023600,000

GigaVUE-HC1

19,00013300,000

Model

Maximum
Connections/Sec.

Maximum
Throughput (Gbps)

Maximum
Concurrent Connections

GigaVUE-HC3

432,000

315

8,000,000

GigaVUE-HC1-Plus

162,000

983,000,000

GigaVUE-HC165,000

453,000,000

GigaVUE-HCT

28,000191,000,000

Out-of-BandNotes• Tested with TLS_AES128_SHA256 cipher suite.
• Throughput based on 2MB file (inline) and 1MB file(out of band).

• Concurrent connections and connections/second
based on 1 byte file.

• For inline specifications, outbound and inboundmodes are identical.

• Performance specifications per model are measuredindependently.

• Values are based on Gigamon internal lab tests andactual results in production could vary.

© 2024 Gigamon. All rights reserved.

6

FEATURE BRIEF | TLS DECRYPTIONConclusionUnlock the potential to uncover concealed threats within both incoming and outgoing encrypted traffic using
the dynamic combination of the Gigamon Deep Observability Pipeline and GigaSMART. Through a single
decryption process, empower seamless information sharing across all tools, effectively scaling and enhancing
the efficiency of each one by eliminating the processor burden. The outcome is a suite of tools operating at thepinnacle of their performance, fully equipped to excel in their specialized role — the mitigation of malware.

Support and Services
Gigamon offers a range of support and maintenance services. For details regarding the Gigamon Limited
Warranty and its Product Support and Software Maintenance Programs, visit gigamon.com/support-andservices/overview-and-benefits.

About Gigamon
Gigamon offers a deep observability pipeline that efficiently delivers network-derived intelligence to yourcloud, security, and observability tools, helping organizations eliminate security blind spots, reduce tool
costs, and better secure and manage your hybrid cloud infrastructure. Gigamon goes beyond security andobservability log-based approaches by extracting real-time network intelligence derived from packets, flows,
and application metadata to deliver defense-in-depth and complete performance management. Gigamon has
served more than 4,000 customers worldwide, including over 80 percent of Fortune 100 enterprises, 9 of the 10
largest mobile network providers, and hundreds of governments and educational organizations worldwide. To
learn more, please visit gigamon.com.

1 For TLS/SSL advanced dashboards, minimum GigaVUE-FM requirements are Medium (ESXi-VM) or higher.
2 Source: Jen Stowe. “NSS Labs Expands 2018 NGFW Group Test with SSL/TLS Security and Performance Test Reports.” NSS Labs, Inc.
July 24, 2018.
3 Source: https://transparencyreport.google.com/https/overview?hl=en
4 Source: https://www.ssllabs.com/ssl-pulse/
5 Source: https://www.zscaler.com/blogs/security-research/2022-encrypted-attacks-report

Worldwide Headquarters
3300 Olcott Street, Santa Clara, CA 95054 USA+1 (408) 831-4000 | gigamon.com© 2019-2024 Gigamon. All rights reserved. Gigamon and Gigamon logos are trademarks of Gigamon in the United States and/or other countries.
Gigamon trademarks can be found at gigamon.com/legal-trademarks. All other trademarks are the trademarks of their respective owners. Gigamon
reserves the right to change, modify, transfer, or otherwise revise this publication without notice.
07.24_35© 2024 Gigamon. All rights reserved.

7