TLS failed. Reason: (336027900, 'error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol').

[PedroNg028067]

Hi, we recently found a lot of blocked connection to our Cisco C100V - Cloud Email Security Appliance due to TLS error. 

Any help is greatly appreciated. Many thanks!!

This is my first time to post question in this community. Sorry that if I posted in the wrong area.

06 Jun 2019 16:18:13 (GMT +08:00)06 Jun 2019 16:18:13 (GMT +08:00)06 Jun 2019 16:18:14 (GMT +08:00)06 Jun 2019 16:18:14 (GMT +08:00)06 Jun 2019 16:18:14 (GMT +08:00)

Protocol SMTP interface Data 1 (IP 139.xxx.xxx..xx) on incoming connection (ICID 316515) from sender IP 165.xxx.xxx.xx Reverse DNS host sendmail.flyasiana.com verified yes.

(ICID 316515) ACCEPT sender group ACCEPTLIST match sbrs[4.0:10.0] SBRS 5.1 sender IP 165.141.xx.xx country Korea, Republic of

(ICID 316515) TLS failed. Reason: (336027900, 'error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol').

(ICID 316515) Unknown command: \\x00\\x009\\x00\\x008\\x00\\x005\\x00\\x00\\x16\\x00\\x00\\x13\\x00\\x00.

Incoming connection (ICID 316515) lost.

[Philip D'Ath]

I'm going to guess this is a typical example of someone scanning to try and find a system they can compromise.

Looking at the command that was logged you can see that it is not valid.

[PedroNg028067]

hi Philip, thanks for your reply! Actually, this ip address belongs to one of our clients, who complains that they can't send us email. Hence, I think it is not caused by someone is scanning our device. 

Any other possible reasons? 

many thanks!

[Ken Stieers]

What TLS versions and ciphers do you have enabled?

[PedroNg028067]

Hi Dennis, thank you very much for your response!

After getting a reply from Cisco, I understand the problem is caused by TLS V.1.0. From 12.x, TLS v.1.0 is disabled by default in Cloud Email Security Appliance but the senders are using using TLS v.1.0. The problem to temporarily fix it is to enable 1.0 until the senders uses 1.1 or above. 

Go to system Administration | SSL Configuration | Enable TLSv1.0 for inbound and outbound

Submit and commit the changes.

Hope that this can help others if they have similar problem.

Thanks!

Pedro

[dmccabej]

Hello,

Glad to hear you figured everything out. :) Thanks for providing us with the fix!

Thanks!

-Dennis M.

[dmccabej]

Hello,

Is this the only sender that you're seeing this issue with? If so, it's most likely to be on their end and they're sending incorrect SMTP commands when trying to perform TLS. You may also want to make sure that SMTP fixup/ESMTP inspection is not enabled on any firewalls for the traffic incoming to your ESA.

Thanks!

-Dennis M.