topic Re: Email not going out in General Topics

Email not going out

ARP — Mon, 15 Sep 2014 12:27:35 GMT

What is the configuration needed for a PA-500 to allow emails to go out. We use exchange and a Cisco spam blocker using port 25. We are recieving emails fine but external emails are not being sent out.

Re: Email not going out

reaper — Mon, 15 Sep 2014 12:35:19 GMT

A regular security policy allowing application smtp with application-default service ports from you exchange and/or spamblocker (depending if you have outbound mail go through the spamblocker as well) to the untrust zone should be enough to allow emails to go out.

you may need to verify if proper NAT is being applied on the outgoing connections via the traffic log or session browser

Re: Email not going out

ARP — Mon, 15 Sep 2014 12:47:10 GMT

Hi,

I have a destination NAT for the cisco block so it can be reach externally. Do I need something else?

Re: Email not going out

hshah — Mon, 15 Sep 2014 12:50:55 GMT

Hi ARP,

Policy and NAT should be enough. Can you please check traffic log for outgoing mails.

Monitor > Traffic > Search with application smtp

If in traffic logs multiple packets are exchanged than its not a policy or NAT issue.

If NO, than its a policy issue.

Provide us Traffic log.

Regards,

Hardik Shah

Re: Email not going out

ARP — Mon, 15 Sep 2014 13:11:58 GMT

Here is the log

Re: Email not going out

hshah — Mon, 15 Sep 2014 13:13:26 GMT

Hi ARP,

Please click on magnifying glass in the beginning and provide that details log.

Regards,

Hardik Shah

Re: Email not going out

ARP — Mon, 15 Sep 2014 13:25:43 GMT

Here it is.

Re: Email not going out

hshah — Mon, 15 Sep 2014 13:27:48 GMT

Hi ARP,

I can see SMTP traffic allowed infact total 25 packets have been exchanged, hence its not a policy issue.

Moreover I can see NAT as well, Its not a NAT issue too.

Next thing you should check errors on Exchange Server. Because firewall configuration appears to be good.

Regards,

Hardik Shah

Re: Email not going out

HULK — Mon, 15 Sep 2014 13:28:35 GMT

A good number of traffic is passing through the PAN firewall. So, from PAN point of view, seems to be working fine.

Thanks

Re: Email not going out

hshah — Mon, 15 Sep 2014 17:07:43 GMT

Let us know for further queries.

Re: Email not going out

ARP — Mon, 15 Sep 2014 17:21:01 GMT

No errors or warnings on the exchange server or Cisco Spam blocker. When I connect the old ASA firewall back up emails go through fine.

Re: Email not going out

hshah — Mon, 15 Sep 2014 17:25:09 GMT

Hello ARP,

Does all the emails dont flow through ?

Is there any Deny log in Threat for SMTP server ?

Can you try to create policy at the top to allow smtp traffic without any profile. That will help us to narrow down issue.

Regards,

Hardik Shah

Re: Email not going out

dmaynard — Mon, 15 Sep 2014 17:32:07 GMT

Can you create a test rule to allow zones inside to outside destination address = 107.14.166.72 application = Any service = Any?

If this allows emails to go out may need evaluate what ports are being used.

Re: Email not going out

ARP — Wed, 17 Sep 2014 16:55:39 GMT

After evaluating what ports were being used I had to allow a few more applications. Which also had some dependant applications.

See below. Thanks for the help!

Re: Email not going out

hshah — Wed, 17 Sep 2014 17:17:45 GMT

Hi APR,

I guess Firewall on 4.1.x image, in 5.0 or later release you don't have to add dependent application.

Regards,

Hardik Shah

Re: Email not going out

ARP — Wed, 17 Sep 2014 17:37:18 GMT

I am running version 6.0.3. When I commited the MS-exchange application there was a warning that there were several application dependancys but the commit was successful. Does that mean that I don't need to add those dependant applications?