Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

POP3S scanning does not work sometimes - BUG

Hi,


POP3 scanning is not working anymore (at least 1 month now). I was able to filter the spam email (by only changing header because at the moment no more action is possible on IMAP/POP3 scanning. Vote http://feature.astaro.com/forums/330219-sophos-xg-firewall/suggestions/10614834-pop3-imap-more-scanning-option).

Since the last month and more, the email are not downloaded anymore. No logs inside XG and Outlook stacks on Downloading Emails. See screnshot.

If I connect without the XG, POP3 is working without problem.

Luk



This thread was automatically locked due to age.
Parents
  • Hi Luk,
    further fiddling. I rebuilt two of my email accounts on MBP and the Mac mini. On the MBP both are now imaps. The impas traffic is sort of scanned if you believe the log file because the headers are changed. I can't see any sign of that in the messages. Some messages have the start of the body changed, but again that is not consistent. The report shows mail trends of large numbers eg about 60 messages delivered and scanned, the mail application shows one pops message.
    There appears to be an issue with the priority of data updates to the XG logging system, mine can take up to 3 minutes before and receipted mail message shows in the reports even when toggling between reports.

    The pops traffic on one other account is scanned, that shows up in the reports.

    The mail setup is very strange.
    I will let this current mail configuration settle for a couple of days so that all the daily tasks and reports are updated.

    Ian,

    home UTM 9.x running in ESXi 6 e3-1275v2

    AP55c and AP10 (courtesy Astaro)

    Three other UTMs, SUM and SFM in hibernation

    XG 15.x MR3 in hibernation

  • Thank you Ian.
    In my situation, the same policy scans IMAP and POP3. Imap is working while pop3 is not. Logs does not give further information. I created another policy rule to allow pop3 otherwise I cannot use the other mailbox.
    It is a bug, for sure!

    Luk
  • Hi Luk,
    I have let my XG stabalise eg not fiddled for two reporting periods.
    My POP3/s is being scanned and subject line being altered.
    My IMAP/s accounts are being scanned with the first couple of line in the message being altered sometimes.
    I am seeing reports of senders and recipients int eh reports from both imap and pop3 accounts.
    There is a bug in the scanning process
    1/. according to the XG I receive many hundreds of imap email a day.
    2/. the log shows them being rewritten
    3/. the log also shows one message as being accepted.

    My theory, but you might not agree having more qualifications on this product. For imap scanning my impression is that the messages is passed from rule to rule and treated differently in each rule and at the end it is passed to the user, not necessarily rejected or accepted. Why I say this is because the log indicates one message (by time stamp) but many rewrites with the odd accept, whereas the pop3/s only has one entry in the log accept or rewrite.
    A couple more days of observation is required., I also think the logging process has some holes because I see messages reported in say yesterday's daily report that arrived the day before.

    Ian M

    Ian,

    home UTM 9.x running in ESXi 6 e3-1275v2

    AP55c and AP10 (courtesy Astaro)

    Three other UTMs, SUM and SFM in hibernation

    XG 15.x MR3 in hibernation

  • Hey Luk,
    are your pop3 users in a group (clientless or real)?

    Ian,

    home UTM 9.x running in ESXi 6 e3-1275v2

    AP55c and AP10 (courtesy Astaro)

    Three other UTMs, SUM and SFM in hibernation

    XG 15.x MR3 in hibernation

  • Ian,
    Thank you for your answer.
    The BAP is not applied to any user but it is applied from LAN to WAN as IMAP (which works). I tried to change POP3 rule to match one user but same behaviour.

    Luk

Reply Children
  • Hi Luk,
    I have number of issues with the scanning processes, so I am going to start a new thread with all the failed scan results.

    Ian,

    home UTM 9.x running in ESXi 6 e3-1275v2

    AP55c and AP10 (courtesy Astaro)

    Three other UTMs, SUM and SFM in hibernation

    XG 15.x MR3 in hibernation