Question

A security team deploys a self-managed third-party IDS as a collector behind an internal passthrough load balancer and configures a Packet Mirroring policy to mirror all ingress and egress traffic from a set of production VMs. After deployment, the IDS reports that it can see the packets but cannot inspect the application-layer payloads of most HTTPS sessions to detect threats. The team asks how to enable deep payload inspection of this encrypted traffic. What is the correct guidance?

Accepted Answer

Packet Mirroring copies packets as-is, so TLS-encrypted payloads remain encrypted; you must terminate/decrypt TLS elsewhere (e.g., at a load balancer or proxy) or perform inspection where plaintext is available.

Answer

Enable the 'decrypt-mirrored-traffic' flag on the Packet Mirroring policy so Google decrypts the payload before forwarding copies to the collector.

Answer

Increase the mirrored packet sampling rate to 100% so the IDS receives complete TLS session keys along with the packets.

Answer

Attach a Cloud Armor edge security policy to the mirrored subnet to strip TLS encryption before packets reach the collector.