ironport : different client hello tls version

[justinus.budi]

I did packet capture on cisco ironport to different public ip address destination.

I have some question why in the wireshark showing different TLS version

 FYI

i have only 1 default destination control

Thanks

[Ken Stieers]

Those are to different servers...
In the 220 TLS go ahead packet, 2 before the TLSv1 packet you point out, it probably says that that server can only support TLS1, so the ironport downgrades... (
I'd have to see the Destination Control config (force encryption/what to do if we can't, etc) and the System Administration\SSL Configuration page (what TLS and ciphers), but I suspect you're configured to allow outbound TLS1.0.

[justinus.budi]

Here i upload the destination control and the ssl configuration

 

 

[José L. Dávila]

Hello there, 

As per configuration, it is likely connection to the second server is downgraded to TLS 1.1.

To confirm which version is negotiated, we would need to take a look to the packet details TLS negotiation. You will find in the lower frame of Wireshark. 

Hope it helps, 

Regards.