SSL Inbound decryption and SMTP

iweltag — Mon, 07 May 2018 14:21:15 GMT

Hi,

does anybody have issues with ssl inbound decryption and setting the smtp decoder in AV Profile to reset-both (antivirus + wildfire)? When the firewall receives an email (with ssl/tls enc enabled) and successfully decrypt the message and found a virus the firewall is not sending a SMTP response code 541. The firewall just block/reset the session. so the sender will never be notified. Without ssl/tls enabled (ssl/tls disabled between spam/av <--> reveiving mailserver) the firewall send a SMTP response code 541.

Example:

Mail server (sending) ---SSL/TLS---> Spam/Antivirus Scan (Cloud-based Internet Security Services) ---SSL/TLS---> PA - Firewall ---> Mail server (receiving)

just wondering - i have also opened a case with pa support. we are running on panos 8.0.8.

thx

bastian

Re: SSL Inbound decryption and SMTP

iweltag — Mon, 25 Jun 2018 08:49:56 GMT

PA does not support sending SMTP response code "541" while SSL Inbound decryption is enabled. It s normal behaviour that the PA just drop the session. You have to configure SSL Forward Proxy instead.

topic Re: SSL Inbound decryption and SMTP in General Topics

SSL Inbound decryption and SMTP

Re: SSL Inbound decryption and SMTP