Just a workaround to turn the Cisco philosophy around and only force outgoing TLS connections. The second match rule will not be applied to the TLS connections cause the encryption… Second the match body line lenght will drop a unsecured connection that basicly can get inspected (cool!) That worked on the ASA 5505 with this configuration:įirst set the allow-tls parameter to allow the TLS connection. So my goal is to force a SMTP with TLS connection when setting up local devices and applications by using the Office 365 relay. When setting up the ‘emailserver of your organisation’ relay in the mailflow connector of the O365 Exchange management both connections SMTP plain and SMTP TLS are allowed. Since the GDPR was finally approved by the EU Parliament, secured email connections has become a discussed item in much organisations. That’s the theory to block the TLS connections So basicly it isn’t possible to inspect the data anymore. When using TLS over SMTP encryption the MTA to MTA connection is encrypted from host to host. Reason is the possibility to inspect the traffic and the ability for traffic classification. If you are using encryption or authentication algorithms with a key length of 256 bits or greater, use Diffie-Hellman group 21.By default Cisco ASA devices have disallowed SMTP TLS traffic on ASA firewalls. ' Guideline: If you are using encryption or authentication algorithms with a 128-bit key, use Diffie-Hellman groups 5,14,19,20, or 24.

IBM z/OS IPSec Documentation - quote from article follows I also find the following IBM document helpful:

I appreciate the info on newer DH groups for ASA. Cisco ASA 5505 Security Plus Firewall Edition Bundle Includes: Unlimited users, 8-port Fast Ethernet switch with 2 Power over Ethernet ports, 25 IPsec VPN peers, 2 SSL VPN peers, DMZ support, Stateless Active/Standby high availability, Dual ISP support, 3DES/AES license.

Asa 5505