Flex Response Rules receive SSL protocol error after upgrading downstream Message Gateway

Products

• Data Loss Prevention Network Monitor and Prevent for Email
• Messaging Gateway

Issue/Introduction

The feature allowing the release of quarantined messages from SMG through the "Release from quarantine" option in the DLP Enforce console is no longer working.

The incident shows the below error:

FlexResponse Action Failed [Email Quarantine Connect Approve Action failed with message:

javax.net.ssl.SSLException:

Received fatal alert: protocol version

Tomcat logs show:

Level: SEVERE

Source: com.vontu.incidentresponse.action.invoker.ActionInvoker

Message: (RESPONSE_ACTION.12) FlexResponse Action [Email Quarantine Connect Approve Action] failed with message: javax.net.ssl.SSLException: Received fatal alert: protocol_version.

Environment

SMG 10.9.0-3, DLP 16.0

Cause

The TLS version used for the connection between Enforce and SMG is no longer supported.

Resolution

Modify the configuration files for flex response to use TLS version 1.2 and/or ciphers in the following three files:

• EmailQuarantineConnectApproved.properties
• EmailQuarantineConnectCustom.properties
• EmailQuarantineConnectRejected.properties

Note: These files are located in <drive>:\SymantecDLP\Protect\plugins

The setting "ssl-protocol-version = TLSv1" should be changed to "ssl-protocol-version = TLSv1.2"

Save the files and restart DLP Enforce services in the correct order