- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
04-11-2018 10:05 AM
Hi,
I just upgraded to 7.1.16 and since that point my Windows server can no longer make a SMTP connection to a mail relay service (outbound.mailhop.org) on port 2525. When I look at the Traffic log, I see the action as reset-both and the threat is "Fragroute Evasion Attack For Unknown-tcp Traffic".
Presuming this is a false positive, what is the best way to create a rule that allows this traffic to pass?
Thanks
-Bob
04-11-2018 01:20 PM
As @OtakarKlier mentioned this is almost certaintly due to the fact that you are using 2525 as an SMTP port. I would create a rule that looks like below.
# set rulebase security rules "SMTP to MailHop" from trust source any to untrust destination MailHop application smtp service tcp-2525 log-end yes action allow description "Allows SMTP traffic to MailHop on 2525" profile-setting group SMTP-Protection-Profile
This assumes that you've set an FQDN address object for MailHop, and that you've setup a service as tcp-2525 and that you modify the profile group to one that you actually utilize.
# set address MailHop description "Used to resolve outbound.mailhop.org" fqdn outbound.mailhop.org
# set service tcp-2525 protocol tcp port 2525
04-11-2018 11:00 AM
Hello,
This could be because you are using smtp over port 2525 which is a non standard port. Create a rule that allows the traffic for the application smtp over port 25 and 2525 and see how that goes.
Regards,
04-11-2018 01:20 PM
As @OtakarKlier mentioned this is almost certaintly due to the fact that you are using 2525 as an SMTP port. I would create a rule that looks like below.
# set rulebase security rules "SMTP to MailHop" from trust source any to untrust destination MailHop application smtp service tcp-2525 log-end yes action allow description "Allows SMTP traffic to MailHop on 2525" profile-setting group SMTP-Protection-Profile
This assumes that you've set an FQDN address object for MailHop, and that you've setup a service as tcp-2525 and that you modify the profile group to one that you actually utilize.
# set address MailHop description "Used to resolve outbound.mailhop.org" fqdn outbound.mailhop.org
# set service tcp-2525 protocol tcp port 2525
04-11-2018 02:56 PM
BPry - That worked - thanks for the fast response!
-Bob
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!