Networks

Ask something
Discussion Locked

Exch 5.5 behind Pix, open relay

0 helpful
11 replies

by charger media

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Exchange 5.5sp4 behind Pix firewall. Pix SMTP filter called Mailguard is on by default. Known issue with Mailguard: breaks Microsoft's authentication packets and won't pass them through. I need to disable open relay and force authentication on emailclients. (we have to be able to relay for 4 domains we host - not my decision but I have to support it) Called Microsoft and they referred me to a fix up on port 25 for the Pix. The fix was applied and I was able to disable open relay, force authentication on mail clients, and send and receive fine. Then we got hit with 40,000+ spam attempts, which ended up stuck in outbound queue, which brought Exchange to a halt for 2 hours. We had to revert back Mailguard on for the Pix to spare the load on our mail server. Now I'm back to square 1. Currently Mailguard is on and open relay is enabled.

I would like to be able to turn off Mailguard (to allow MS authentication), disable open relay, force clients to authenticate and keep the spam attempts from reaching my Exchange server. The only apparent ways I can see accomplishing this is by firewall filtering or setting up an email server in front of our Exchange server.

Thoughts and ideas are greatly appreciated.

11 replies

by greybeard770

We have good success with Norton Antivirus for e-mail gateways. It has a screen where you can list domains you will relay mail for and the IP address for the domain. That way you can totally hide your exchange server from the outside. The software also allows some spam filtering based on the subject line. The gateway server sits in the DMZ and it is the only server that can communicate with the Exchanger server in the LAN. Just point your MX record to the Norton Gateway. Your Exchange server can still send mail to the Internet.

by shmaltz

First I'll need someinfo.
1. When your where hit with the spam, where those emails for your domains? or to be relayed by your email server to other domains? If it was the formere than it wasn't really spam but email bombing.
2. I'm not familiar with Mailguard, does it filter against spam or relaying? or both?

by charger media

They were trying to relay through our mail server to other domains.
Mailguard limits SMTP commands to a specified minimum set of commands.

by acattr

In exchange admin, in the routing tab under the internet mail connector. set it to do routing. input your four domains as inbound. select the restrictions tab, and only checkbox the "clients....that successfully authenticate". stop and restart the internet mail service.

I did this and my server no longer relays. You can test your server at http://www.ordb.org/submit.

If you still get the spam, someone is authenticating. Enable logging on the Internet mail connector, and see what accounts they are using. logs are kept on installdrive:\exchsrvr\icmdata.

by shmaltz

In Exchange you can prohibit relaying. Which will eliminate the need for MailGuard. You can specify to which domain you are allowed to relay and block the rest.

by charger media

When I disable open relay, the email bogs down Exchange by hanging in the outbound queue eating up CPU. It looks like we're going to have to place an email gateway/filtering server in front of it.

by noufal

i have faced the saim problem ,and stoped open relaying foe the three mail server here.
1 mail.islam.gov.qa
2 mail.islamweb.net.qa
3 mail.islamweb.net
first one i solved with exchange relay option
second with norton antivirus email gateway
third imail mail relay option
which one u want .i will send u details

This discussion is closed to new replies.