DLP Enforce - FlexResponse Action Filed (SMG Integration)

[User 2001]

Hi. has anyone seen the error below?
It's thrown when I try to apply a FlexResponse rule to allow or deny an email that was quarantined by our SMG.
This is a new install and our Enforce server is running on Red Hat EL 7.

I am able to reflect mail from the SMG to the Email Detect servers. (yay!)
A test policy is working, it matches a test string and the response rule quarantines the message as expected. (yay!)
The SMG is reporting to the Enforce server that the message was quarantined, however, when I try to release or reject the message
this error appears in the incident history: (booh!)


FlexResponse Action Failed
[Email Quarantine Connect Approve Action] failed with message: Input error when reading response from email gateway: java.io.IOException: Server returned HTTP response code: 500 for URL: https://smg1.acmex.com:8443/brightmail/ws/DlpQuarantineActionsService


I can manually browse this SMG URL and a page of SMG links is served.

I also confirmed that the Enforce server can open this URL (using wget, so I don't think it's a firewall issue)

Support asked me to restart the SMGs, I did but this didn't help.

thanks!

[Alex Hedley]

Did you follow the "Symantec_DLP_11.6_Email_Quarantine_Connect_FlexResponse_Implementation_Guide.pdf" guide and update the configuration files necessary in each of the FRs? Added the cert?

------------------------------
Alex Hedley | Senior Developer | Protirus
------------------------------

[User 2001]

Thanks for the reply.
I'm working off of: Symantec_DLP_15.5_Email_Quarantine_Connect_FlexResponse_Implementation_Guide
configs and certs look good.

[Stephen Heider]

Hi - one thing I don't see in the 15.5 guide is specific guidance around this setting in the EmailQuarantineConnectCustom.properties file:

# SSL protocol version. Could be TLSv1 or TLSv1.2
ssl-protocol-version = TLSv1

Asking because even though your error doesn't seem to reflect it, we do need this to be TLSv1.2, not 1.

https://knowledge.broadcom.com/external/article?articleId=169867

If you do make a change, please do restart the SymantecDLPManagerService and Incident Persister services.

------------------------------
Global Support Lead, DLP
Broadcom, Symantec Enterprise Division
------------------------------

[User 2001]

Thanks for the reply. I did set TLSv1.2 on the plugin properties files.
At this point I have a support case open an the SMG team is reviewing some diag files.

Cheers!

"The problem with quotes on the Internet is that it is hard to verify their authenticity."
Abraham Lincoln

[User 2001]

Thanks to everyone who reminded me to check certs - I thought the were good but..

I fixed the issue by carefully repeating all of the certificate steps in the guide.
I was missing the Enforce server's client cert from the certstore.jks.

I made the mistake of assuming "that couldn't be the problem" since the Enforce server and SMGs were talking to each other
(Messages were being quarantined via SMTP header changes, and the SMG was able to report to Enforce that a message was quarantined)