Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 4 replies
  • Subscribers 0 subscribers
  • Views 13749 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Bypass Data Control Encryption for a specific domain

EOB

I'm trying to configure my ES1100 to bypass Data Control encryption only for one specific domain. My company has a partner using TLS encryption and we want to avoid having our users unnecessarily using the data control encryption process for PII between our organizations.

I got it done easily enough by configuring an outbound rule to check the header for the desired domain, say "@partner.com" and that works, but if there's a CC in the message, such as "@stranger.com" they also get the message unencrypted.

How can I configure the device to send the message unencrypted to the trusted domain and an encrypted copy to the untrusted domain OR if an untrusted domain is present send it encrypted to everyone, ie allow it to bypass encryption only if @partner.com is the only destination.

That's a mouthful, I hope I explained myself clearly.

Thanks!

:50668


This thread was automatically locked due to age.
Parents
  • 0

    I'm trying to configure my ES1100 to bypass Data Control encryption only for one specific domain.

    go into the data control rule and modify the selected users tab.

    click exclude recipient

    custom group

    enter either @abc.com for the whole domain.. or fred@abc.com for just fred.

    add.

    save

    "I got it done easily enough by configuring an outbound rule to check the header for the desired domain, say "@partner.com" and that works, but if there's a CC in the message, such as "@stranger.com" they also get the message unencrypted."

    keep in mind data control rules are processed before additional policy rules, so if your encryption rule is DC and your exclusion is an additional policy, it will never trigger

    "How can I configure the device to send the message unencrypted"

    the appliance will always try encryption first if it fails then it will send it in plain text.  If you wish to exchange public keys with the company you can add it to your certificates and create TLS rules for that domain under the encryption tab.

    :50708
Reply
  • 0

    I'm trying to configure my ES1100 to bypass Data Control encryption only for one specific domain.

    go into the data control rule and modify the selected users tab.

    click exclude recipient

    custom group

    enter either @abc.com for the whole domain.. or fred@abc.com for just fred.

    add.

    save

    "I got it done easily enough by configuring an outbound rule to check the header for the desired domain, say "@partner.com" and that works, but if there's a CC in the message, such as "@stranger.com" they also get the message unencrypted."

    keep in mind data control rules are processed before additional policy rules, so if your encryption rule is DC and your exclusion is an additional policy, it will never trigger

    "How can I configure the device to send the message unencrypted"

    the appliance will always try encryption first if it fails then it will send it in plain text.  If you wish to exchange public keys with the company you can add it to your certificates and create TLS rules for that domain under the encryption tab.

    :50708
Children
No Data
Unfiltered HTML