RE: [fw-wiz] Cisco PIX Version 6.3(3) SMTP Problem

From: Hammerle, Tye (Tye.F.Hammerle_at_snapon.com)
Date: 07/06/05

  • Next message: Paul Robertson: "Re: [fw-wiz] Cisco PIX Version 6.3(3) SMTP Problem" 
    To: "'David M. Nicksic'" <dnicksic@mossbaygroup.com>, "'Paul D. Robertson'" <paul@compuwar.net>
Date: Wed, 6 Jul 2005 11:27:37 -0500

    Postini can spool mail if your gateway is unreachable. Talk to your support
    rep.

    tye

    -----Original Message-----
    From: firewall-wizards-admin@honor.icsalabs.com
    [mailto:firewall-wizards-admin@honor.icsalabs.com] On Behalf Of David M.
    Nicksic
    Sent: Wednesday, July 06, 2005 10:06 AM
    To: 'Paul D. Robertson'
    Cc: firewall-wizards@honor.icsalabs.com
    Subject: RE: [fw-wiz] Cisco PIX Version 6.3(3) SMTP Problem

    Thank you for your comments about Postini, that is most helpful.

    DN

    -----Original Message-----
    From: Paul D. Robertson [mailto:paul@compuwar.net]
    Sent: Wednesday, July 06, 2005 5:51 AM
    To: David M. Nicksic
    Cc: firewall-wizards@honor.icsalabs.com
    Subject: Re: [fw-wiz] Cisco PIX Version 6.3(3) SMTP Problem

    On Tue, 5 Jul 2005, David M. Nicksic wrote:

    > I am using a PIX 520 v 6.3.3 and having a spam problem. A spam service
    > Postini is employed. I want to deny all SMTP traffic unless it comes
    > from one of the Postini servers. Can the PIX be configured to
    > accomplish this?
    >

    Almost any firewall can, however you'll be out of e-mail if the provider has
    to put up a new server because of an attack, failure, problem or address
    change. It's probably better to configure your mail server to reject based
    on forward/reverse lookups, since you're dealing with one zone, you'll be
    able to cache the lookups pretty well.

    Note that Postini rejects mail if your server isn't reachable by it- so it's
    not all that resilient if you're under attack or having server issues[1].
    Personally, I'd rather run Mailscanner on a Postfix instance than outsource
    something as critical as e-mail.

    Paul
    [1] Theoretically most things will retry, but you may want to test critical
    pager/cell/alert stuff to make sure it won't just give up if you're under
    conditions where contacting you becomes important.
    ----------------------------------------------------------------------------
    -
    Paul D. Robertson "My statements in this message are personal opinions
    paul@compuwar.net which may have no basis whatsoever in fact."

    _______________________________________________
    firewall-wizards mailing list firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Paul Robertson: "Re: [fw-wiz] Cisco PIX Version 6.3(3) SMTP Problem"

    Relevant Pages

    • Re: SMTP Connector to Postini Outbound Service
      ... Postini's recommendation is to use Microsoft Exchange Connectors with ... this Postini recommends a short retry interval to avoid causing large ... If a receiving mail server returns a 400-series error to Postini ... Outbound, then the SMTP error will be relayed back to the connector, ...
      (microsoft.public.exchange.admin)
    • Re: Tracking Log Interpretation
      ... No I am not using postini at all and the 3rd party app is configured as you ... If all this application needs is access to your SMTP server to send mail, ... folder and 1 external recipient. ...
      (microsoft.public.exchange2000.admin)
    • RE: [fw-wiz] Cisco PIX Version 6.3(3) SMTP Problem
      ... Thank you for your comments about Postini, ... It's probably better to configure your mail server to ... reject based on forward/reverse lookups, ...
      (Firewall-Wizards)
    • Re: [fw-wiz] Cisco PIX Version 6.3(3) SMTP Problem
      ... > Almost any firewall can, however you'll be out of e-mail if the provider ... It's probably better to configure your mail server to ... I would ask Postini for the network where their recipient verificaion ... > it's not all that resilient if you're under attack or having server ...
      (Firewall-Wizards)
    • Re: Restricting Inbound SMTP Traffic
      ... > Do you have ISA installed on this SBS? ... > 'This remote computer' and enter the IP of your postini server and click OK. ... > Dick Miller wrote: ...
      (microsoft.public.windows.server.sbs)