IPS rejects encrypted mail

Michal_W_old — Thu, 20 Aug 2020 16:19:54 GMT

Hi,

For general awareness, as this might loose you e-mail if you're not looking at your smtp logs, if you have IPS set to strict and you expect to receive SMTP with opportunistic encryption (STARTTLS), IPS will drop certain SMTP connections.

I couldn't find a knowledge base article with a few quick searches, to here are the details.

Tested on 790 GW with R77.20.87 build 3004.

The protection "SMTP STARTTLS Command" (smtp_starttls_enable)" will be enabled on strict, or custom IPS settings that include it.

The corresponding postfix log after setting the signature to detect, looks like the following

postfix/smtpd[25955]: Anonymous TLS connection established from XXXX[199.7.a.b]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)

You can set the IPS signature it to detect and log manually in case you need to correlate events.

Re: IPS rejects encrypted mail

G_W_Albrecht — Fri, 21 Aug 2020 07:53:08 GMT

Again a reason to not use the Strict IPS policy - in addition to not to use Strict Firewall Policy...

topic IPS rejects encrypted mail in Spark Firewall (SMB)

IPS rejects encrypted mail

Re: IPS rejects encrypted mail