SMTP Relay failing after PA update

[iiidmaxer]

Hi,

I just upgraded to 7.1.16 and since that point my Windows server can no longer make a SMTP connection to a mail relay service (outbound.mailhop.org) on port 2525.  When I look at the Traffic log, I see the action as reset-both and the threat is "Fragroute Evasion Attack For Unknown-tcp Traffic".

Presuming this is a false positive, what is the best way to create a rule that allows this traffic to pass?

Thanks
-Bob

[OtakarKlier]

Hello,

This could be because you are using smtp over port 2525 which is a non standard port. Create a rule that allows the traffic for the application smtp over port 25 and 2525 and see how that goes.

Regards,

[BPry · Accepted solution]

@iiidmaxer,

As @OtakarKlier mentioned this is almost certaintly due to the fact that you are using 2525 as an SMTP port. I would create a rule that looks like below.

# set rulebase security rules "SMTP to MailHop" from trust source any to untrust destination MailHop application smtp service tcp-2525 log-end yes action allow description "Allows SMTP traffic to MailHop on 2525"  profile-setting group SMTP-Protection-Profile 

This assumes that you've set an FQDN address object for MailHop, and that you've setup a service as tcp-2525 and that you modify the profile group to one that you actually utilize. 

# set address MailHop description "Used to resolve outbound.mailhop.org" fqdn outbound.mailhop.org

# set service tcp-2525 protocol tcp port 2525

[iiidmaxer]

BPry - That worked - thanks for the fast response!

-Bob