topic Re: MTA with SMTP over TLS in General Topics

MTA with SMTP over TLS

Olga_Kuts — Mon, 05 Mar 2018 15:03:52 GMT

When we enable the MTA with SMTP over TLS, the mails are decrypted on the CheckPoint, and checked with certain blades. Are the messages encrypted back when they are transferred to a internal server after checking?

Re: MTA with SMTP over TLS

Daniel_Taney — Mon, 05 Mar 2018 18:01:20 GMT

Others can correct me here, but it was my understanding it stays decrypted and just gets handed off to the mail server.

Re: MTA with SMTP over TLS

Norbert_Bohusch — Mon, 05 Mar 2018 21:05:39 GMT

By default the backend SMTP connection to nexthop is in clear but there is a way to configure it also for TLS with parameter “smtp_use_tls=yes” in $FWDIR/conf/mta_postfix_options.cf on MTA gateway.

Re: MTA with SMTP over TLS

Olga_Kuts — Mon, 05 Mar 2018 21:10:45 GMT

Thanks f lot for your reply!

But I have one more question: are there nuances in mta_postfix_options.cf change шт case when we have VSX gateway and enable MTA on the one VS?

Re: MTA with SMTP over TLS

Norbert_Bohusch — Mon, 05 Mar 2018 21:13:49 GMT

I don’t know for sure. I assume Thomas Werner can answer this!

Re: MTA with SMTP over TLS

HeikoAnkenbrand — Tue, 06 Mar 2018 11:04:24 GMT

- Config MTA sk108553 and sk101870 (you can use Postfix MTA settings)

- VSX are supported on GAIA R80.10 (see sk79700)

Threat Emulation MTA (Mail Transfer Agent) support in VSX. You can run MTA for each VS instance (sk111841)

Regards

Heiko

Re: MTA with SMTP over TLS

Thomas_Werner — Tue, 06 Mar 2018 16:03:55 GMT

Hi Olga,

FWDIR/conf is specific to each VS environment - the folder looks like $FWDIR/CTX/CTX0000<VSID>/conf/. So you can specify one dedicated MTA conf per VS. Also MTA is enabled per VS.

Regards Thomas