topic Re: Decryption of SMTP using STARTTLS in General Topics

Decryption of SMTP using STARTTLS

JohnKerekes — Wed, 05 Oct 2016 13:01:22 GMT

Our current setup with Exchange uses SMTP with STARTTLS. We have a requirement from the business to try and decrypt/inspect the traffic. I configured decryption policy the same way as we do for our SSL web servers, but it doesn't seem to be working. The firewall App-ID will identiry the traffic as SMTP, but the decrypted flag is not set in the logs and pcap don't work since the firewall doesn't allow decrypted packets to be captured anyway.

Has anyone been able to get decryption with SMTP/STARTTLS to work (or other protocols with STARTTLS)? Is this even supported by the firewall? I opened a ticket with support, but they have yet to give me a straight answer as to whether this is supported on the firewall.

Re: Decryption of SMTP using STARTTLS

bmorris1 — Wed, 05 Oct 2016 13:15:15 GMT

Hello,

I believe this is supported:

https://live.paloaltonetworks.com/t5/Configuration-Articles/App-IDs-for-SSL-Secured-Versions-of-Well-Known-Services/ta-p/57428

You'll probably want to use inbound decrpytion to decrypt this your mail traffic.

https://live.paloaltonetworks.com/t5/Learning-Articles/Difference-Between-SSL-Forward-Proxy-and-Inbound-Inspection/ta-p/55553

Also you could apply for a decryption port mirror license if you wanted to capture unencrypted traffic that the firewall decrypts.

hope this helps,

Ben

Re: Decryption of SMTP using STARTTLS

JohnKerekes — Thu, 13 Oct 2016 11:46:27 GMT

Thanks, Ben.

According to TAC they think it is supported. The issue might on our end with the encryption cipher. The STARTTLS traffic is using PFS with Elliptical Curve that doesn't appear to be in the supported ciphers list for decryption. We are trying to figure out how we can change it to a supported cipher.