Problems with TLS traffic

[KWOODS1229]

I have several ASA 5540 firewalls in place and one of them is

causing me a lot of ulcer time.

I am trying to pass Secure LDAP traffic through to an internal server.  Everything goes well until the server attempts to respond to the authentication on a different port.  The firewall blocks the outbound traffic and the connection drops.

I have set up access rules to pass the LDAPS to the internal server, I have set up a NAT rule for the internal server, I have done everything else that I can think of short of pulling the firewall out.

Does anyone know of a best practice for TLS on the 5540?  We are having similar problems with FTPS and SMTPS as well, but nobody is screaming about them at the moment.

[Jennifer Halim]

Yes, with all the secure/encrypted applications like FTPS, SMTPS, LDAPS, the ASA is not able to inspect the data packet because it is encrypted, hence when the application dynamically negotiates for a different port for the actual data connection, it will fail because ASA can't read encrypted packet and because it is not part of the existing connection, it will drop the packet. The best you can do is to configure ACL in both direction to allow the packet to go through to and from the server. This is common for any other firewalls unless it supports and performs man-in-middle to decrypt the traffic.