topic Re: SMTP Relay failing after PA update in General Topics

SMTP Relay failing after PA update

iiidmaxer — Wed, 11 Apr 2018 17:05:46 GMT

Hi,

I just upgraded to 7.1.16 and since that point my Windows server can no longer make a SMTP connection to a mail relay service (outbound.mailhop.org) on port 2525. When I look at the Traffic log, I see the action as reset-both and the threat is "Fragroute Evasion Attack For Unknown-tcp Traffic".

Presuming this is a false positive, what is the best way to create a rule that allows this traffic to pass?

Thanks
-Bob

Re: SMTP Relay failing after PA update

OtakarKlier — Wed, 11 Apr 2018 18:00:23 GMT

Hello,

This could be because you are using smtp over port 2525 which is a non standard port. Create a rule that allows the traffic for the application smtp over port 25 and 2525 and see how that goes.

Regards,

Re: SMTP Relay failing after PA update

BPry — Wed, 11 Apr 2018 20:20:13 GMT

@iiidmaxer,

As @OtakarKlier mentioned this is almost certaintly due to the fact that you are using 2525 as an SMTP port. I would create a rule that looks like below.

# set rulebase security rules "SMTP to MailHop" from trust source any to untrust destination MailHop application smtp service tcp-2525 log-end yes action allow description "Allows SMTP traffic to MailHop on 2525" profile-setting group SMTP-Protection-Profile

This assumes that you've set an FQDN address object for MailHop, and that you've setup a service as tcp-2525 and that you modify the profile group to one that you actually utilize.

# set address MailHop description "Used to resolve outbound.mailhop.org" fqdn outbound.mailhop.org

# set service tcp-2525 protocol tcp port 2525

Re: SMTP Relay failing after PA update

iiidmaxer — Wed, 11 Apr 2018 21:56:53 GMT

BPry - That worked - thanks for the fast response!

-Bob