Abstract: In some implementations, a network device configured as a secure sockets layer forward proxy may receive network traffic associated with an identity. The network device may transmit, using mutual transport layer security, a request for a client certificate associated with the identity. The network device may receive, responsive to the request, the client certificate. The network device may receive, based on the client certificate, identity-specific authentication entry information. The network device may selectively transmit further network traffic based on the identity-specific authentication entry information. The network device may delete, based on the client certificate, a session associated with the identity.

Abstract: Techniques for advertising device inspection capabilities to enhance network traffic inspections are described herein. The techniques may include determining, by a first inspection device of a network, that a second inspection device is disposed within the network. The first inspection device may also receive, from the second inspection device, an indication that the second inspection device is capable of performing a first type of inspection. The techniques may also include receiving, at the first inspection device, a packet that is to be sent through the network along a path that includes the second inspection device. Based at least in part on the path including the second inspection device, the first inspection device may refrain from performing the first type of inspection on the packet at the first inspection device such that the second inspection device can perform the first type of inspection on the packet.

Abstract: Techniques for advertising device inspection capabilities to enhance network traffic inspections are described herein. The techniques may include determining, by a first inspection device of a network, that a second inspection device is disposed within the network. The first inspection device may also receive, from the second inspection device, an indication that the second inspection device is capable of performing a first type of inspection. The techniques may also include receiving, at the first inspection device, a packet that is to be sent through the network along a path that includes the second inspection device. Based at least in part on the path including the second inspection device, the first inspection device may refrain from performing the first type of inspection on the packet at the first inspection device such that the second inspection device can perform the first type of inspection on the packet.