How to setup Email Quarantine with Symantec DLP 26.1
search cancel

How to setup Email Quarantine with Symantec DLP 26.1

book

Article ID: 451748

calendar_today

Updated On:

Products

Data Loss Prevention Core Package

Issue/Introduction

How to setup Email Quarantine with Symantec DLP 26.1 natively

Environment

DLP 26.1+

Resolution

There are 2 configuration sides here.  First is SMG and second is Enforce server.

Step 1 (Configuring SMG):

First lets create a policy to quarantine emails that DLP has flagged.

    1. In SMG – Content – Policies – Email
    2. Add a new Policy – Blank Policy – Click Select
    3. Type in Policy Name
    4. Select Outbound messages under conditions.
    5. Click Add under conditions
    6. Under Message contains select Header and set the value to ‘X-dlp-uniquemsgid’
    8. Click Add condition at the bottom.
    9. Add another rule with the same conditions but this time set the header value to ‘X-dlp-policyid” *Note only one header will still work if needed and can be either one. 
    11. Now under Actions click Add
    12. Under Configure An Action select “Create a quarantine incident” Under In Content quarantine incident folder, select ‘Quarantine Incidents’ then click Add Action.
    14. Next under each action select ‘Add Approved Action’/’Add Reject Action’/’Add Custom Action’
    15. For example see below.
    17. Make sure a policy group is selected under Policy Groups and hit save.
    18. Once saved make sure there is a green check mark under enabled.
    19. This will create an quarantine incident every time an email comes in with the headers specified above and have actions assigned to them.

 

Next we need to setup the connection to DLP.  Documentation for this can be found here.

    1. Click on Content – Settings – DLP Connect
    2. Click on the ‘Enforce Server Access’ tab.
    3. Fill in the IP Address of the Enforce server as well as the Username and Password.
    4. Click Save.

 

Next We need to export out the certificate used by SMG that will be used for communication with DLP.

    1. Click on Administration – Control Center – Certificates (tab)
    2. Here you will find the certificate that will be used for the communication with DLP. Take note of the name.
    3. Now click on Administration – Settings – Certificates – TLS & HTTPS
    4. Now select the certificate we saw earlier.
    5. Click on the Export button and save this Certificate to import into the DLP Keystore. This certificate is used by DLP to verify the certificate the SMG will provide and trust it.

 

Next we need to import the certificate that will be supplied by DLP for communication.  This will make sure DLP presents a trusted certificate.  Recommend to complete the DLP setup before this step as you need the cert from DLP to import into SMG.

    1. Click on Administration – Certificates – Applications (tab)
    2. Import the certificate supplied by DLP. ** Note ** If CA signed certificates are used, you will need to import each certificate included in the chain.  Please see the KB here for this.
    3. In the example below the filename should be EnforceCert.cer.
    4. Next we do need to change the format of EnforceCert.cer into pem.
      1. Double click EnforceCert.cer in windows to open it.
      2. Click on the Details Tab.
      3. Click “Copy to File”
      4. Click Next
      5. Export it as Base64 enforce x.509 (.cer) format.
      7. Click Next.
      8. Click browse and save it as EnforcCertPem.cer somewhere you can easily find it and click Finish.
    5. Under the applications tab, click Import and import the EnforceCertPem.cer file.
    6. ** Important Note** if this certificate is signed by a CA, you need to import the full chain here one certificate at a time. So if the full chain of the certificate contains say a Root then a Subordinate CA and then your certificate, then you will need to import each one separately into this tab.  So you should have a total of 3 new certificates added to this tab.
    7. Once this is complete you need to restart the control center or the whole SMG.
      1. Administration – Hosts – Shutdown
      2. Select ‘Local Host” under Host field.
      3. Click on the reboot button.

 

Step 2 (Configuring DLP):

First we need to create a keystore that DLP can used to provide and trust the certificate with SMG.  Note:  DLP 26.1 does NOT require any plugins to be installed.  Email Quarantine is built natively into the product.

    1. First create a directory called EnforceSMGCert under root drive as we will place new keystore and all files in this directory.
      1. Windows command: "<DRIVE>:\Program Files\AdoptOpenJRE\jdk<version>-jre\bin\keytool" -genkeypair -alias EnforceQuarantine -keyalg RSA -keysize 2048 -validity 730 -dname "CN=<servername>, OU=DLP, O=SYMANTEC, L=Cupertino, ST=California, C=US" -ext SAN=DNS:<servername>,DNS:<domainname>,DNS:<FQDN>,IP:<IPAddress> -keystore <DRIVE>:\EnforceSMGCert\EnforceSMG.jks -storepass protect
      2. Linux command: /<path>/AdoptOpenJRE/jdk<version>-jre/bin/keytool -genkeypair -alias EnforceQuarantine -keyalg RSA -keysize 2048 -validity 730 -dname "CN=<servername>, OU=DLP, O=SYMANTEC, L=Cupertino, ST=California, C=US" -ext SAN=DNS:<servername>,DNS:<domainname>,DNS:<FQDN>,IP:<IPAddress> -keystore /<path>/EnforceSMGCert/EnforceSMG.jks -storepass protect
      3. dname: this tells us who the certificate belongs to, feel free to change the information here as needed.
      4. SAN: this tells us what servers this certificate matches. If the domain used to access the site does not match the DNS names listed here, then the certificate will be invalid.
      5. keystore: the output path can be set to anywhere, but in this case it is creating a new keystore in your EnforceSMGCert directory.
      6. Note you can append -keypass <your password> to then end of the argument so you can see the password as you are typing it.
    2. Note if you would like to sign the certificate by your CA, you can the KB here as the process is exactly the same.
    3. Next we need to export out the public certificate so this can be imported into SMG. This was the last section under SMG so DLP and SMG can trust each other.
      1. Windows command: "<DRIVE>:\Program Files\AdoptOpenJRE\jdk<version>-jre\bin\keytool" -exportcert -alias EnforceQuarantine -keystore <DRIVE>:\EnforceSMGCert\EnforceSMG.jks -file <DRIVE>:\EnforceSMGCert\EnforeCert.cer
      2. Linux command: /<path>/AdoptOpenJRE/jdk<version>-jre/bin/keytool -exportcert -alias EnforceQuarantine -keystore /<path>/EnforceSMGCert/EnforceSMG.jks -file /<path>/EnforceSMGCert/EnforeCert.cer
      3. Note you can append -keypass <your password> to then end of the argument so you can see the password as you are typing it.
    4. Next we need to import the SMG certificate that was exported out earlier and import this into this keystore.

  Next were going to setup DLP so it knows where to find the SMG.

    1. Login to the Enforce 26.1 console
    2. Click System – Settings – General
    3. Click Configure (top left)
    4. Under ‘Symantec Messaging Gateway Email Quarantine Connect Settings” fill out the following:
      1. Host – this is the dns name or the fqdn of the SMG. Example: smg.mydomain.local
      2. Port – thi sis the port used to connect to SMG. Set this to 8443.
      3. TLS Protocol Version (max) – Earlier versions of SMG did not support TLS 1.3 so recommend using TLS 1.2. Later versions did have a bug so best to have the latest version of SMG or confirm TLS 1.3 is working on that version before using TLS 1.3.  Use the KB here on how to setup TLS 1.2 on Enforce.
      4. Install Client Certificate (.jks) – This is actually the keystore and not the certificate as the name suggests. Click on the browse button and select EnforceSMG.jks from the EnforceSMGCert folder where all of this is saved.
      5. Keystore Password – This is the password to the EnforceSMG.jks keystore.
      6. Remediator User – This is the user you will use for remediation. For testing you can use Administrator but please make sure to create a user to be used here.
    5. Click ‘Save’ on the top left.
    6. Once saved you can click ‘Configure’ again and click on the ‘Test Connection’ button under the heading ‘Symantec Messaging Gateway Email Quarantine Connect Settings’.
      1. If the test failed AND you are using a proxy on the Enforce console. This would be specified under the ‘Enforce to Cloud Proxy Settings’ heading.
      3. If this is specified you can bypass the proxy for SMG traffic by the following the kb here.
    7. Once the test connection is successful, this portion is complete.

 

Next we need to create a Response Rule for the headers.

    1. Login to the Enforce 26.1 console
    2. Click Manage – Policies – Response Rules
    3. We need 2 response rules here.
      1. First we need a rule to add SMTP headers.
        1. Click ‘Add Response Rule’
        2. Select ‘Automated Response’ as type and click Next.
        3. Type in a rule name. For example ‘Email Quarantine SMTP Headers’
        4. Under the Actions click on the drop down.
        5. Select ‘Modify SMTP Message’ under ‘Network Prevent’
        6. Click ‘Add Action’ button
        7. At the very bottom of the settings select ‘Enable Email Quarantine Connect (Requires Symantec Messaging Gateway)’.  This is what adds the headers that will be used by SMG to quarantine the message.
        9. Click ‘Save’ on the top left.
      2. Second rule we need for Approve/Reject/Custom Response rules. This will create a button on the incident page to manually execute an action.
        1. Click ‘Add Response Rule’
        2. Select ‘Smart Response’ as type and click Next.
        3. Type in a rule name. For example ‘Quarantine - Approve'
        4. Under the Actions click on the drop down.
        5. Select ‘SMG Email Quarantine Connect; Approve’ and click ‘Add Action’ button.
        6. Click ‘Save’ on top left.
        7. Repeat the same process for Reject and Custom as needed.
      3. Next add these response rules to a policy that should quarantine an email.
        1. Click Manage – Policies – Policy List.
        2. Edit any policy you need.
        3. Click on the ‘Response’ tab and add the ‘Email Quarantine SMTP Headers’ response rule.
        4. Click ‘Save’
      4. Lastly you will need to add the response rule called 'Email Quarantine SMTP Headers' to a policy which will in turn tell 
        DLP to add the headers we specified which will tell SMG to quarantine the message.
      5. Setup is now complete and you should be able to test Quarantining and Releasing an email.

To test try the following:

  1. First send an email that will trigger the policy that contains the response rule 'Email Quarantine SMTP Headers'
  2. On SMG you should see the email on hold.
    1. Login to the SMG console
    2. click Content tab
    3. click Quarantine Incidents under Quarantine Folders
    4. Click Display
    5. You should see your test email with Message State of 'Being Held'.
  3. On DLP you should see the incident with the quarantine icon.
    1. login to Enforce console
    2.  Look under incidents and find the incident that was triggered with the 'Email Quarantine SMTP Headers' response rule.
    3. Click on ‘Quarantine - Approve' button on top of the screen.
    4. Click on the Notes tab.
    5. You should see a successful event and you should see a green check mark on the quarantine icon of the incident.
    6. On SMG you should see the email Message State of 'Approved'.

For any troubleshooting its best to collect the following:

SMG

  • Administration - Uiilities - Diagnostics (tab)
  • Select 'Local Host' for Host
  • Select 'all log data' for components
  • click 'Generate'
  • Once package is generated click on the download button.

DLP

  • System - Servers and Detectors - Logs
  • Click 'Collect Logs'
  • Select 'Last 24 Hours' for Date Range.  As long as the issue was reproduced in the last 24 hours.  If not select a longer time range.
  • Under 'Enforce Server:' select 'Operations Logs' and 'Debug and Trace Logs' and 'Configuration Files'
  • Click 'Collect Logs'
  • Once generated, download the logs.

Aside from this a packet capture can be very helpful with the issue reproduced.  This can be taken on SMG/Enforce server.

If an HTTP 500 is seen due to certificate chain requirements, please see the KB here.

Additional Information

About integrating Symantec Data Loss Prevention with Symantec Messaging Gateway

https://techdocs.broadcom.com/us/en/symantec-security-software/email-security/messaging-gateway/10-9-2/encrypting-data-with-symantec-content-encryption/about-integrating-symantec-dlp-with-smg.html

 

 

Powered by Wolken Software