This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM blocking 1 internal user outgoing

Just started a couple hours ago. Everything she sends from outlook our exchange servers sends to the UTM and they bounce back. Other users arent having problems. Here's one from the log....

1VA0dh-0003pL-38 DKIM: d=lifelock.com s=dkimrnt16925 c=simple/simple a=rsa-sha1 i=@lifelock.com t=1376584988 [invalid - syntax error in public key record]
1VA0di-0003pP-1N ctasd reports 'Confirmed' RefID:str=0001.0A020207.520D00B3.020F,ss=4,sh,re=0.000,recu=0.000,reip=0.000,cl=4,cld=1,fgs=12
1VA0dh-0003pL-38 ctasd reports 'Suspect' RefID:str=0001.0A020207.520D051E.0118,ss=2,re=0.000,recu=0.000,reip=0.000,cl=2,cld=1,fgs=0
1VA0dh-0003pL-38 member.services@lifelock.com H=rntca67.rnmk.com [216.136.162.67]:20183 P=esmtp S=24513 id=RNTM.AvUE~wqVCv8S1GdlGvEe~yL~Jvsq~y7~Mv~3~zr~.0.1376584988.0CfMM9Qn2Dk!@websc18.int.rightnowtech.com
1VA0di-0003pP-1N id="1003" severity="info" sys="SecureMail" sub="smtp" name="email rejected" srcip="REMOVED-LOCALIP" from="REMOVED-USERNAME@REMOVED-DOMAIN.com" to="REMOVED" subject="test" queueid="1VA0di-0003pP-1N" size="2591" reason="as" extra="confirmed"
1VA0di-0003pP-1N H=REMOVED-SERVER-NAME (smtp01.REMOVED-DOMAIN.com) [REMOVED-LOCALIP]:11432 F= rejected after DATA

Ideas?

This thread was automatically locked due to age.

Parents

0 BAlfson over 11 years ago

Well, this is an unusual problem. It looks like it's time to contact your reseller to open a support ticket at Sophos.

Cheers - Bob

Sorry for any short responses. Posted from my iPhone.

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 JasonIstre over 11 years ago in reply to BAlfson

Support didn't really have a workable solution. I finally found a solution:

It has to do with x-originating IP header.

Fix for Exchange to remove the x-originating IP header:
Heiner's Blog: Exchange Server 2010 & the "x-originating-ip" header
more info here: Disable the x-originating-ip in the mail headers. - Email and calendar - Office 365 - Microsoft Office 365 Community
more info here: Know Your Headers: x-originating-ip | All Things Exchange

Seems like this is maybe a bug and UTM should be aware of x-originating-ip header for internal emails? Kind of sucks that I have to have exchange strip it off everything as a work around.

Seems like anyone with Outlook Anywhere or Outlook Webmail and Exchange using UTM with outbound filtering would be seriously affected.

I can't control whether the public NAT IPs of coffee shops, airports, hospitals, and others guest wireless are on a known blacklist. In fact, I shouldn't have too or even care about it for my internal server to send out emails for my encrypted secure outlook clients or even IOS devices. I can't be the only one using exchange securely with traveling users and UTM?!

Sorry, little bit of a rant here.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 JasonIstre over 11 years ago in reply to BAlfson

Support didn't really have a workable solution. I finally found a solution:

It has to do with x-originating IP header.

Fix for Exchange to remove the x-originating IP header:
Heiner's Blog: Exchange Server 2010 & the "x-originating-ip" header
more info here: Disable the x-originating-ip in the mail headers. - Email and calendar - Office 365 - Microsoft Office 365 Community
more info here: Know Your Headers: x-originating-ip | All Things Exchange

Seems like this is maybe a bug and UTM should be aware of x-originating-ip header for internal emails? Kind of sucks that I have to have exchange strip it off everything as a work around.

Seems like anyone with Outlook Anywhere or Outlook Webmail and Exchange using UTM with outbound filtering would be seriously affected.

I can't control whether the public NAT IPs of coffee shops, airports, hospitals, and others guest wireless are on a known blacklist. In fact, I shouldn't have too or even care about it for my internal server to send out emails for my encrypted secure outlook clients or even IOS devices. I can't be the only one using exchange securely with traveling users and UTM?!

Sorry, little bit of a rant here.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data