Decryption of SMTP using STARTTLS

Reply
Highlighted
L1 Bithead

Decryption of SMTP using STARTTLS

Our current setup with Exchange uses SMTP with STARTTLS.  We have a requirement from the business to try and decrypt/inspect the traffic.  I configured decryption policy the same way as we do for our SSL web servers, but it doesn't seem to be working.  The firewall App-ID will identiry the traffic as SMTP, but the decrypted flag is not set in the logs and pcap don't work since the firewall doesn't allow decrypted packets to be captured anyway.

 

Has anyone been able to get decryption with SMTP/STARTTLS to work (or other protocols with STARTTLS)?  Is this even supported by the firewall?  I opened a ticket with support, but they have yet to give me a straight answer as to whether this is supported on the firewall.

Tags (3)
L4 Transporter

Re: Decryption of SMTP using STARTTLS

Hello,

 

I believe this is supported:

 

https://live.paloaltonetworks.com/t5/Configuration-Articles/App-IDs-for-SSL-Secured-Versions-of-Well...

 

You'll probably want to use inbound decrpytion to decrypt this your mail traffic.

 

https://live.paloaltonetworks.com/t5/Learning-Articles/Difference-Between-SSL-Forward-Proxy-and-Inbo...

 

Also you could apply for a decryption port mirror license if you wanted to capture unencrypted traffic that the firewall decrypts.

 

hope this helps,

Ben

L1 Bithead

Re: Decryption of SMTP using STARTTLS

Thanks, Ben.

 

According to TAC they think it is supported.  The issue might on our end with the encryption cipher.  The STARTTLS traffic is using PFS with Elliptical Curve that doesn't appear to be in the supported ciphers list for decryption.  We are trying to figure out how we can change it to a supported cipher.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!