Cisco Cisco Email Security Appliance C160 Mode D'Emploi

Select Network > SMTP Authentication.

Click Add Profile.

Enter the name for the SMTP authentication profile. 

Select Certificate for the Profile Type.

Click Next.

Enter the profile name.

Select the certificate LDAP query you want to use with this SMTP authentication profile.

Do not select the option to allow the SMTP AUTH command if a client certificate is not 
available.

Click Finish.

Submit and commit your changes.

The Verify Client Certificate option in the RELAYED mail flow policy directs the Email Security 
appliance to establish a TLS connection to the user’s mail application if the client certificate is valid. If 
you select this option for the TLS Preferred setting, the appliance still allows a non-TLS connection if 
the user doesn’t have a certificate, but rejects a connection if the user has an invalid certificate. For the 
TLS Required setting, selecting this option requires the user to have a valid certificate in order for the 
appliance to allow the connection.

To authenticate a user’s SMTP session with a client certificate, select the following settings:

TLS - Required

Verify Client Certificate

Require SMTP Authentication

Although SMTP authentication is required, the Email Security appliance will not use the SMTP 
authentication LDAP query because it is using certificate authentication.

To authenticate a user’s SMTP session using the SMTP authentication query instead of a client 
certificate, select the following settings for the RELAYED mail flow policy:

TLS - Required

Require SMTP Authentication

If you require the Email Security appliance to ask for a client certificate from certain users while 
allowing LDAP-based SMTP authentication from others, select the following settings for the RELAYED 
mail flow policy:

TLS - Preferred