Email not going out

[ARP]

What is the configuration needed for a PA-500 to allow emails to go out.  We use exchange and a Cisco spam blocker using port 25. We are recieving emails fine but external emails are not being sent out.

[reaper]

Hi

A regular security policy allowing application smtp with application-default service ports from you exchange and/or spamblocker (depending if you have outbound mail go through the spamblocker as well) to the untrust zone should be enough to allow emails to go out.

you may need to verify if proper NAT is being applied on the outgoing connections via the traffic log or session browser

[ARP]

Hi,

I have a destination NAT for the cisco block so it can be reach externally.  Do I need something else?

[hshah]

Hi ARP,

Policy and NAT should be enough. Can you please check traffic log for outgoing mails.

Monitor > Traffic > Search with application smtp

If in traffic logs multiple packets are exchanged than its not a policy or NAT issue.

If NO, than its a policy issue.

Provide us Traffic log.

Regards,

Hardik Shah

[ARP]

Here is the log

[hshah]

Hi ARP,

Please click on magnifying glass in the beginning and provide that details log.

Regards,

Hardik Shah

[ARP]

Here it is.

[hshah]

Hi ARP,

I can see SMTP traffic allowed infact total 25 packets have been exchanged, hence its not a policy issue.

Moreover I can see NAT as well, Its not a NAT issue too.

Next thing you should check errors on Exchange Server. Because firewall configuration appears to be good.

Regards,

Hardik Shah

[HULK]

A good number of traffic is passing through the PAN firewall. So, from PAN point of view, seems to be working fine.

Thanks

[hshah]

Let us know for further queries.

[ARP]

No errors or warnings on the exchange server or Cisco Spam blocker.  When I connect the old ASA firewall back up emails go through fine.

[hshah · Accepted solution]

Hello ARP,

Does all the emails dont flow through ?

Is there any Deny log in Threat for SMTP server ?

Can you try to create policy at the top to allow smtp traffic without any profile. That will help us to narrow down issue.

Regards,

Hardik Shah

[dmaynard]

Can you create a test rule to allow zones inside to outside destination address = 107.14.166.72 application = Any service = Any?

If this allows emails to go out may need evaluate what ports are being used.

[ARP]

After evaluating what ports were being used I had to allow a few more applications.  Which also had some dependant applications.

See below.  Thanks for the help!

[hshah]

Hi APR,

I guess Firewall on 4.1.x image, in 5.0 or later release you don't have to add dependent application.

Regards,

Hardik Shah