SMTP Inbound Decryption

[Han.Valk]

I am trying to setup inbound decryption for SMTP (TLS) using the default Decryption Profile.

What destination IP address do I use in the Decryption Policy: public pre-NAT or private post-NAT?

Regards,

Han.

[Remo]

--> the public per-NAT IP

[Remo]

PS: right now I cannot find it anymore but I remember that the firewall is only able to send back an SMTP 541 error in forward decryption mode and not with knbound decryption ...