Cisco
Login
Search

Encrypted Traffic Handling Decryption Rules and Policy Example Associate the Decryption Policy with an Access Control Policy and Advanced Settings

Last updated: Aug 18, 2025

Associate the Decryption Policy with an Access Control Policy and Advanced Settings

This task discusses how to associate the decryption policy with an access control policy and setting recommended advanced settings for the access control policy.

For your decryption policy to be used by the system, you must associate it with an access control policy.

Before you begin

Create the sample decryption policy as discussed in this guide.

For more information about decryption policy advanced options, see Decryption Policy Advanced Options.

Procedure

1

Log in to the Secure Firewall Management Center if you haven't already done so.

2

Click Policies > Access Control heading > Access Control.
3

Either create a new access control policy or click Edit (edit icon) to edit an existing one.
4

Click the word Decryption as the following figure shows.

In the firewall management center, for the access control policy, click the word Decryption to select a decryption policy to associate

5

From the list, click the name of your decryption policy and also check Early application detection and URL categorization as the following figure shows.

For the selected decryption policy, select the Early application detection and URL categorization check box

6

Click Apply.
7

Click More > Advanced Settings as the following figure shows.

Select the access control policy's Advanced Settings

8

Click Edit (edit icon) next to TLS Server Identity Discovery.
9

Select the check box as the following figure shows.

In the access control policy's Advanced Settings, select the Server Identity Discovery check box

10

Click OK.
11

At the top of the page, click Save.
12

At the top of the page, click Return to Access Control Policy Management, as the following figure shows

At the top of the page, click Return to Access Control Policy Management

13

Click Edit (edit icon) to edit the access control rule.
14

At the bottom of the page, next to the default action, click (Default Logging and Inspection).
15

Check Log at beginning of connection and any other options you choose.

For more information, see Logging Settings for Access Control Policies Logging Settings for Access Control Policies in the Cisco Secure Firewall Management Center Device Configuration Guide.
16

Click Apply.
17

At the top of the page, click Save.

What to do next

Previous topic Optional Example: Manual Decryption Rule to Monitor or Block Certificate Distinguished Name Next topic Traffic to Prefilter