Our current setup with Exchange uses SMTP with STARTTLS. We have a requirement from the business to try and decrypt/inspect the traffic. I configured decryption policy the same way as we do for our SSL web servers, but it doesn't seem to be working. The firewall App-ID will identiry the traffic as SMTP, but the decrypted flag is not set in the logs and pcap don't work since the firewall doesn't allow decrypted packets to be captured anyway.
Has anyone been able to get decryption with SMTP/STARTTLS to work (or other protocols with STARTTLS)? Is this even supported by the firewall? I opened a ticket with support, but they have yet to give me a straight answer as to whether this is supported on the firewall.
I believe this is supported:
You'll probably want to use inbound decrpytion to decrypt this your mail traffic.
Also you could apply for a decryption port mirror license if you wanted to capture unencrypted traffic that the firewall decrypts.
hope this helps,
According to TAC they think it is supported. The issue might on our end with the encryption cipher. The STARTTLS traffic is using PFS with Elliptical Curve that doesn't appear to be in the supported ciphers list for decryption. We are trying to figure out how we can change it to a supported cipher.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!