Modern L7 firewalls do a lot more than just MITM, and they can do it without MITM. Take a look at Palo Alto's applipedia[1], it has 4419 protocols/services tha

Modern L7 firewalls do a lot more than just MITM, and they can do it without MITM. Take a look at Palo Alto's applipedia[1], it has 4419 protocols/services that you can detect and write security policy for without decrypting anything. One example, last week our firewall blocked a suspicious (but but in this case legitimate) site using DNS sinkholing, because the domain seemed suspicious (uncommon TLD + recently registered domain). [1]: https://applipedia.paloaltonetworks.com/ https://applipedia.paloaltonetworks.com/