Cipher order and Key exchange parameters

Hi Wesley van den Brink,

Thank you for reaching out to the Community! 

Would it be possible for you to share email protection configuration detail from your firewall? 

Thanks,

Good morning Patel,

Maybe a stupid question. But how can i get this? (this device is new for me)

Hoi Wesley and welcome to the UTM Community!

Cheers - Bob

Thanks Bob 

Require TLS Neg Sender Domains are only domain names no wildcard.

And, what happens if you put "Any" in '... Sender Domains'?

TLS v1.2 is required in the EU, so, depending on your organization's correspondents, you may not need to worry about this.  In the USA, I see many domains that aren't at 1.2.

Cheers - Bob

Anyipv4 and ipv6 are in now, problem is stil there.
At least one of your mail servers supports insufficiently secure parameters for Diffie-Hellman key exchange.

Technical details:

Ahhh, I didn't read closely enough.  I guess your TLS certificate is the problem.  You can generate a new one with a 4096-bit key to replace the one you're currently using.  Better luck with that, Wesley?

Cheers - Bob

Put in a 4096 Bits certificate but same error message (2048 is generally aproved and a valid one, but we could always try)

After using the new cert a reboot was done.

Warning:

Errors:

At least one of your mailservers does not enforce its own cipher preference ('I').

Technical details:

Verdict:

At least one of your mail servers supports insufficiently secure parameters for Diffie-Hellman key exchange.

Technical details:

Put in a 4096 Bits certificate but same error message (2048 is generally aproved and a valid one, but we could always try)

After using the new cert a reboot was done.

Warning:

Errors:

At least one of your mailservers does not enforce its own cipher preference ('I').

Technical details:

Verdict:

At least one of your mail servers supports insufficiently secure parameters for Diffie-Hellman key exchange.

Technical details:

So, it's the cert at mx.*****.nl.  What happens if you change that?

Cheers - Bob

Hi Bob,

Allready changed the certificate for a 4096 bit but stil the same errors.

I contacted our certificate supplier but they are saying that its not the certificate but it need to be change on the UTM.

Their translated message:

Furthermore, the links you send are aimed at the Cipher Suites and/or Protocols that are used. This is not something that can be set on the certificate, but this is done at the server level. It is best to contact the supplier of the product for any adjustments.

OK, Wesley, my last guess.  What happens if you temporarily put "Any" in ' Require TLS Negotiation Hosts/Nets'?  If that doesn't do it, it's time to open a case with Sophos Support.

Thanks for the link to www.internet.nl/mail/{domain} - great tool!

Cheers - Bob

Hi Bob,

This was the first thing we tried ;)

Any4 and Any6 are listed.

How can i open a support ticket?

When i try to make a ticket i get the following message:

https://3.id.sophos.com/token_proxy

Hoi Wesley,

Since you're in Europe, if you don't have Premium Support, I think your reseller has to open a ticket for you.  I'm in North America and that's not the case here.

Cheers - Bob