Decryption of SMTP using STARTTLS

[JohnKerekes]

Our current setup with Exchange uses SMTP with STARTTLS.  We have a requirement from the business to try and decrypt/inspect the traffic.  I configured decryption policy the same way as we do for our SSL web servers, but it doesn't seem to be working.  The firewall App-ID will identiry the traffic as SMTP, but the decrypted flag is not set in the logs and pcap don't work since the firewall doesn't allow decrypted packets to be captured anyway.

Has anyone been able to get decryption with SMTP/STARTTLS to work (or other protocols with STARTTLS)?  Is this even supported by the firewall?  I opened a ticket with support, but they have yet to give me a straight answer as to whether this is supported on the firewall.

[bmorris1 · Accepted solution]

Hello,

I believe this is supported:

https://live.paloaltonetworks.com/t5/Configuration-Articles/App-IDs-for-SSL-Secured-Versions-of-Well...

You'll probably want to use inbound decrpytion to decrypt this your mail traffic.

https://live.paloaltonetworks.com/t5/Learning-Articles/Difference-Between-SSL-Forward-Proxy-and-Inbo...

Also you could apply for a decryption port mirror license if you wanted to capture unencrypted traffic that the firewall decrypts.

hope this helps,

Ben

[JohnKerekes]

Thanks, Ben.

According to TAC they think it is supported.  The issue might on our end with the encryption cipher.  The STARTTLS traffic is using PFS with Elliptical Curve that doesn't appear to be in the supported ciphers list for decryption.  We are trying to figure out how we can change it to a supported cipher.