TLS between ESA and Exchange

[ccna_security]

Dear all. I have a question. I want to enable TLS between ESA and Exchange Server. What is the best practice regarding TLS options. Prefered or Required? And should I check Verify Client Certificate? I would be thankful if you help me to find an answer for this question.

[balaji.bandi]

I was doing last year some research while iam doing some PoC to test. but i have implemented some other solution as per the business requirement.

but there are good resources i have gathered may help you.

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118844-technote-esa-00.html

https://community.cisco.com/t5/email-security/enabling-tls-on-esas/td-p/2617813

https://jaapwesselius.com/2017/02/23/cisco-ironport-and-exchange-2016/

https://enterpriseit.co/ironport/setup-tls-ironport/

[ccna_security]

Hello Balaji

The link you sent is related to TLS configuration. I enabled it in outside interface as Prefered TLS. the question is that which option would be better in inside interface. From our ESA to our exchange server.should I choose Required or Prefered?

[balaji.bandi]

how is this internal network connected ? do you have any FW between ESA / and Exchage ?

[ccna_security]

Yes we have internal firewall 

[marc.luescherFRE]

My take on it is the following :

if both ESA and Exchange are internal - > TLS prefered

if ESA is in DMZ and Exchange is internal -> TLS required, if SSL from trusted 3rd party, even with verify

It all depends on your firewall policy and what they need and allow.

We do SMTP packet inspection on our external firewalls but not on our internal one so for us it does not make a big difference as all our mail servers are in a separate protected subnet.

We have trusted certs on all our ESA/SMA and mail servers. BUt most internal devices use internal SSL certs from our MS PKI, so we do not enforce TLS for internal devices unless it needs to cross into the DMZ.

Hope that helps

-Marc

[ccna_security]

As i understood i should choose TLS prefered if both firewall and esa is inside network right? 

[marc.luescherFRE · Accepted solution]

Yes that would be my recommendation as you don't need the additional TLS enforced overhead internal

[ccna_security]

Thank you Marc