Cisco Cisco Email Security Appliance X1050 Troubleshooting Guide
Determine if ESA is Using TLS for Delivery or
Receiving
Receiving
Document ID: 118500
Contributed by Nasir Shakour and Robert Sherwin, Cisco TAC
Engineers.
Engineers.
Oct 14, 2014
Contents
Introduction
Determine if ESA is Using TLS for Delivery or Receiving
Related Information
Determine if ESA is Using TLS for Delivery or Receiving
Related Information
Introduction
This document describes how to determine if Transport Layer Security (TLS) is used for delivery or receiving
on the Cisco Email Security Appliance (ESA).
on the Cisco Email Security Appliance (ESA).
Determine if ESA is Using TLS for Delivery or Receiving
TLS is an improved version of the Secure Socket Layer (SSL) technology. It is a widely−used mechanism for
encrypting SMTP conversations over the Internet.
encrypting SMTP conversations over the Internet.
The ESA can establish connections to remote hosts using TLS or require TLS when remote hosts establish
connections. TLS connections are recorded in the mail logs along with other significant actions related to
messages such as filter actions, anti−virus and anti−spam verdicts, and delivery attempts. If there is a
successful TLS connection, there will be a "TLS success" entry in the mail logs. Likewise, a failed TLS
connection will produce a "TLS failed" entry. If a message does not have an associated TLS entry in the log
file, that message was not delivered over a TLS connection.
connections. TLS connections are recorded in the mail logs along with other significant actions related to
messages such as filter actions, anti−virus and anti−spam verdicts, and delivery attempts. If there is a
successful TLS connection, there will be a "TLS success" entry in the mail logs. Likewise, a failed TLS
connection will produce a "TLS failed" entry. If a message does not have an associated TLS entry in the log
file, that message was not delivered over a TLS connection.
Below are examples of successful and failed TLS connections. You are able to see the log entries from review
of message tracking on the GUI, or using grep to parse the mail logs on the CLI. Please review the ESA
Message Disposition Determination article for further assistance.
of message tracking on the GUI, or using grep to parse the mail logs on the CLI. Please review the ESA
Message Disposition Determination article for further assistance.
Successful TLS connection from remote host (Receiving):
Wed Jul 20 19:47:40 2005 Info: New smtp ICID 282204970 interface Management
(10.10.10.1) address 192.168.1.1 reverse dns host unknown verified no
Wed Jul 20 19:47:40 2005 Info: ICID 282204970 ACCEPT SG None match SBRS None
Wed Jul 20 19:47:40 2005 Info: ICID 282204970 TLS success
Wed Jul 20 19:47:40 2005 Info: Start MID 200257070 ICID 282204970
Failed TLS connection from remote host (Receiving):
Tue Jun 28 19:08:49 2005 Info: New SMTP ICID 282204971 interface Management
(10.10.10.1) address 192.168.1.1 reverse dns host unknown verified no
Tue Jun 28 19:08:49 2005 Info: ICID 282204971 ACCEPT SG None match SBRS None
Tue Jun 28 19:08:49 2005 Info: ICID 282204971 TLS failed
Tue Jun 28 19:08:49 2005 Info: ICID 282204971 lost