Re: POP3 mail servers seen as intruders
- From: "William Robertson" <william.robertson@xxxxxxxxx>
- To: "'[ISAserver.org Discussion List]'" <isalist@xxxxxxxxxxxxx>
- Date: Tue, 26 Nov 2002 19:54:02 +0200
Hi Jim
I understand your comment regarding the fact that any TCP/IP
communication that is ended prematurely by either side of the connection
will result in ISA Server seeing the rest of that communication as an
intruder.
My problem is that I am only really seeing this to be a problem with the
external POP3 mail servers, so what I am hoping to do is either increase
some sort of SMTP timeout value (I've seen some talk about the NOOP
command but have no idea what it is and whether I should be playing with
it to resolve this problem) or alternatively telling the Firewall
component of ISA Server to relax a bit more with regards to timeouts for
Firewall connections. I know I can do this for the "Outgoing WEB
Request" but how do I do this for the Inbound/Outbound SMTP requests?
Cheers
William R.
-----Original Message-----
From: Jim Harrison [mailto:jim@xxxxxxxxxxxx]
Sent: 23 November 2002 20:38 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] Re: POP3 mail servers seen as intruders
http://www.ISAserver.org
You'll also see this when the internal POP client has closed the
connection
before the "conversation" was completed.
It's not just P
Or, it's any TCP conversation that gets abruptly terminated and the
remote
server didn't react properly, or maybe didn't even get the "I'm done"
part
of the conversation.
IE will cause this during browsing because instead of closing a TCP
connection properly, it simply resets it.
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/pages/author_index.asp?aut=3
http://isatools.org
Read the help / books / articles!
----- Original Message -----
From: "William Robertson" <robertson.william@xxxxxxxxxxxxxx>
To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
Sent: Thursday, November 21, 2002 9:48 PM
Subject: [isalist] POP3 mail servers seen as intruders
http://www.ISAserver.org
Hi there
I have an interesting problem in that I have at least 3 external POP3
mail
servers which ISA logs Intruder Alerts for. The 3 servers are notoriusly
busy so I am under the impression that there is some sort of a timeout
taking place on th eISA Server and then when the external mail server
tries to reply to my mail server, the ISA Server has already "closed"
that
session. If this is the case then ISA would surely see the external
request as an intruder as it it is trying to communicate on an
un-established session.
What I need to know is the following:
1) Does the above statement make any sense. I.e. Is it true?
2) How can I get the ISA Server to permit longer sessions for the mail
server.
Cheers
William R.
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Exchange Server Resource Site: http://www.msexchange.org/
Windows Security Resource Site: http://www.windowsecurity.com/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
jim@xxxxxxxxxxxx
To unsubscribe send a blank email to
$subst('Email.Unsub')
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Exchange Server Resource Site: http://www.msexchange.org/
Windows Security Resource Site: http://www.windowsecurity.com/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
robertson.william@xxxxxxxxxxxxxx
To unsubscribe send a blank email to
$subst('Email.Unsub')
Other related posts:
