SMTP Relay failing after PA update

Reply
L0 Member

SMTP Relay failing after PA update

Hi,

 

I just upgraded to 7.1.16 and since that point my Windows server can no longer make a SMTP connection to a mail relay service (outbound.mailhop.org) on port 2525.  When I look at the Traffic log, I see the action as reset-both and the threat is "Fragroute Evasion Attack For Unknown-tcp Traffic".

 

Presuming this is a false positive, what is the best way to create a rule that allows this traffic to pass?

Thanks
-Bob

L7 Applicator

Re: SMTP Relay failing after PA update

Hello,

This could be because you are using smtp over port 2525 which is a non standard port. Create a rule that allows the traffic for the application smtp over port 25 and 2525 and see how that goes.

 

Regards,

L7 Applicator

Re: SMTP Relay failing after PA update

@iiidmaxer,

As @Otakar.Klier mentioned this is almost certaintly due to the fact that you are using 2525 as an SMTP port. I would create a rule that looks like below.

 

# set rulebase security rules "SMTP to MailHop" from trust source any to untrust destination MailHop application smtp service tcp-2525 log-end yes action allow description "Allows SMTP traffic to MailHop on 2525"  profile-setting group SMTP-Protection-Profile 

 

This assumes that you've set an FQDN address object for MailHop, and that you've setup a service as tcp-2525 and that you modify the profile group to one that you actually utilize. 

 

# set address MailHop description "Used to resolve outbound.mailhop.org" fqdn outbound.mailhop.org

# set service tcp-2525 protocol tcp port 2525

L0 Member

Re: SMTP Relay failing after PA update

BPry - That worked - thanks for the fast response!

 

-Bob

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!