Decryption of SMTP using STARTTLS

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Decryption of SMTP using STARTTLS

L1 Bithead

Our current setup with Exchange uses SMTP with STARTTLS.  We have a requirement from the business to try and decrypt/inspect the traffic.  I configured decryption policy the same way as we do for our SSL web servers, but it doesn't seem to be working.  The firewall App-ID will identiry the traffic as SMTP, but the decrypted flag is not set in the logs and pcap don't work since the firewall doesn't allow decrypted packets to be captured anyway.

 

Has anyone been able to get decryption with SMTP/STARTTLS to work (or other protocols with STARTTLS)?  Is this even supported by the firewall?  I opened a ticket with support, but they have yet to give me a straight answer as to whether this is supported on the firewall.

2 REPLIES 2

L4 Transporter

Hello,

 

I believe this is supported:

 

https://live.paloaltonetworks.com/t5/Configuration-Articles/App-IDs-for-SSL-Secured-Versions-of-Well...

 

You'll probably want to use inbound decrpytion to decrypt this your mail traffic.

 

https://live.paloaltonetworks.com/t5/Learning-Articles/Difference-Between-SSL-Forward-Proxy-and-Inbo...

 

Also you could apply for a decryption port mirror license if you wanted to capture unencrypted traffic that the firewall decrypts.

 

hope this helps,

Ben

Thanks, Ben.

 

According to TAC they think it is supported.  The issue might on our end with the encryption cipher.  The STARTTLS traffic is using PFS with Elliptical Curve that doesn't appear to be in the supported ciphers list for decryption.  We are trying to figure out how we can change it to a supported cipher.

  • 7046 Views
  • 2 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!