No - you can't interfere with an ssl connection without causing red flags all over the users' screens.
Layer7 firewall matcher looks into the packet payload - which with SSL is going to be encrypted, right?
...
The entire purpose of SSL is end-to-end security which should always defeat a middlebox.
If you don't care about ssl warnings, then if you have a web server with URL rewriting capabilities, set it up to rewrite
www.google.com ->
www.google.com/ncr , put a self-signed certificate on the server, and then you can intercept DNS and give the IP of your web server for
www.google.com
(dstnat - redirect udp 53, set up IP > dns to allow remote requests)
Remember that this solution is going to give the end user an invalid certificate warning, no matter what you do, except:
hack google and steal their private SSL key
find a trusted CA who will sign a CSR from you for *.google.com
force every user to add your private CA as a trusted authority and issue yourself a google.com cert and sign it with your own CA.
(all of these are bad - and any user who allowed #3 should be given a computer class in security, because then you would have the power to sandbox their bank website and they would get no alarms!)