Snort blocking encrypted email attachment

[gilbert.aispuro1]

Hello All,

Not sure if I'm in the right community but I have Snort running on all edge devices, and I'm seeing that encrypted emails and their attachments are not retrievable by the recipient. 

I know the domain of the end party trying to send the encrypted document but not sure how to apply a whitelist signature.

How do I go about this? I don't want to completely disable Snort. 

Edge Devices:

FTD's managed by FMC

SD-WAN cEDGE Routers

[Octavian Szolga]

Hi Gilbert,

First, you need to confirm that your emails are indeed blocked by FTD.

You can check this by using nslookup/DNS and check the MX RR for the sending domain.

Then check FMC-> IPS Events/ File Events/Connection Events and look for drop/block events related to that specific IP.

Afterwards, if this is indeed the issue, you can create a separate firewall rule for SMTP traffic with the only purpose of attaching to it a custom IPS/AMP policy that does not block encrypted email attachments.

One reason for which your encrypted email attachments may not make it through the firewall is AMP (File Policy) where you might have enabled an advanced option like block encrypted archives/files or something similar.

Please take into account that encrypted file attachments can be blocked by FTD only if you're using plain old SMTP, that is with no STARTTLS.

BR,

Octavian