Overview

TLS Inspection allows you to securely inspect encrypted TLS/HTTPS traffic that enters your cloud resources.
The system decrypts the traffic, applies security inspection using an Intrusion Prevention System (IPS), and then re-encrypts the traffic before forwarding it to the destination.

This enables protection against threats hidden inside encrypted traffic while maintaining end-to-end security.

How TLS Inspection Works

Incoming TLS/HTTPS traffic reaches the firewall rule.

Traffic is temporarily decrypted using a certificate you provide.

Security inspection is applied using IPS policies.

Traffic is re-encrypted and forwarded to your Virtual Machine or Load Balancer.

Inspection Method

Intrusion Prevention System (IPS)
IPS policies are applied during inspection to detect and prevent malicious traffic before it reaches your workload.

When TLS Inspection Can Be Enabled

TLS Inspection is available only for:

 1- Incoming firewall rules

 2- Traffic originating from: Internet or Shared Area 

Prerequisites

Before enabling TLS Inspection:

A valid certificate must exist in Certificate Manager.

The firewall rule must be an incoming rule from internet or shared.

You must have permission to modify firewall rules.

Enabling TLS Inspection

TLS Inspection can be enabled from:

• Virtual Machine → Firewall Rules
• Load Balancer → Firewall Rules

Steps

Navigate to the firewall rules page.

Locate the incoming rule you want to modify.

Enable TLS Inspection by selecting a certificate from the Certificate Manager.

Click Submit.  

The certificate is associated with the firewall rule and inspection becomes active immediately.

Certificate Associations

You can view where a certificate is used from Certificate Manager.

The Associated To column displays usage such as:

1 firewall rule in VM: <vm_name>

8 firewall rules in LB: <lb_name>

Clicking the association redirects you to the corresponding resource.

The certificate overview also lists all associated firewall rules.

Logging and Visibility

Traffic inspected through TLS Inspection appears in Firewall Logs, consistent with other firewall rule logs.
No additional configuration is required.