http://www.ISAserver.org ------------------------------------------------------- Wouldn't be if you disabled the filter altogether. If you can telnet and get a "blank line," that means that you have established a TCP connection, but that something is keeping the application layer from communicating properly. If you couldn't connect at all, you would get a "connection failed" message. so, you are at least connecting and doing a 3 way handshake - it's not mx or dns in that case. Can these hosts telnet to other published services like HTTP? But, what Jim originally suggested is the way to go- time for a capture. t On 1/18/07 7:02 PM, "ISA" <ISA@xxxxxxxxxxxxxxxx> spoketh to all: > http://www.ISAserver.org > ------------------------------------------------------- > > 1024 - no good! > > Joseph Danielsen, MCSA-Messaging, MCP > > Network Blade Inc. > > 49 Marcy Street > > Somerset, NJ 08873 > > 732-213-0600 > > www.networkblade.com > > > > > > > -----Original Message----- > From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx] > On Behalf Of Thomas W Shinder > Posted At: Thursday, January 18, 2007 9:56 PM > Posted To: ISA > Conversation: [isalist] Re: SMTP Connection Closed > Subject: [isalist] Re: SMTP Connection Closed > > http://www.ISAserver.org > ------------------------------------------------------- > > Change NOOP to 1024 > > Thomas W Shinder, M.D. > Site: www.isaserver.org > Blog: http://blogs.isaserver.org/shinder/ > Book: http://tinyurl.com/3xqb7 > MVP -- Microsoft Firewalls (ISA) > > > >> -----Original Message----- >> From: isalist-bounce@xxxxxxxxxxxxx >> [mailto:isalist-bounce@xxxxxxxxxxxxx] On Behalf Of ISA >> Sent: Thursday, January 18, 2007 8:49 PM >> To: isalist@xxxxxxxxxxxxx >> Subject: [isalist] Re: SMTP Connection Closed >> >> http://www.ISAserver.org >> ------------------------------------------------------- >> >> Nope! The only thing I changed was the NOOP to 20 (per Thor's advise). >> First time I ever messed around with the Proto filters. Exchange box: >> Dell PE2800 2GB mem. ISA: Dell PE1430 1GB mem. Both doing nothing but >> handling mail for 3 mail accounts. >> >> Joseph Danielsen, MCSA-Messaging, MCP >> >> -----Original Message----- >> From: isalist-bounce@xxxxxxxxxxxxx >> [mailto:isalist-bounce@xxxxxxxxxxxxx] >> On Behalf Of Greg Mulholland >> Posted At: Thursday, January 18, 2007 9:42 PM >> Posted To: ISA >> Conversation: [isalist] Re: SMTP Connection Closed >> Subject: [isalist] Re: SMTP Connection Closed >> >> http://www.ISAserver.org >> ------------------------------------------------------- >> >> gotta be some sort of connect limit, i would have thought >> noop as well. >> Have >> you customised any of your smtp rules or smtp filters beyond >> the normal >> setup? have you customised any of the settings exchange connection >> limit >> settings >> >> whats the hardware specs of the exchange box and isa box? >> >> how long do you wait for the before banner before closing the window? >> >> >> Greg >> ----- Original Message ----- >> From: "ISA" <ISA@xxxxxxxxxxxxxxxx> >> To: <isalist@xxxxxxxxxxxxx> >> Sent: Friday, January 19, 2007 1:29 PM >> Subject: [isalist] SMTP Connection Closed >> >> >> http://www.ISAserver.org >> ------------------------------------------------------- >> >> >> Nothing at all - >> I enter telnet mail.domain.com 25 (hit enter) the line disappears and >> the curser just sits there and blinks - no banner - nothing. If I hit >> enter again it goes back to the C:\ prompt. >> >> I tried the steps in that article mentioned earlier - but I can't get >> passed the first step (mentioned above). However, I see the port 25 >> attempt on the ISA firewall logs - then is CLOSES after 5 seconds. >> >> >> Joseph Danielsen, MCSA-Messaging, MCP >> >> Network Blade Inc. >> >> 49 Marcy Street >> >> Somerset, NJ 08873 >> >> 732-213-0600 >> >> www.networkblade.com >> >> >> >> >> >> >> -----Original Message----- >> From: isalist-bounce@xxxxxxxxxxxxx >> [mailto:isalist-bounce@xxxxxxxxxxxxx] >> On Behalf Of Thor (Hammer of God) >> Posted At: Thursday, January 18, 2007 9:24 PM >> Posted To: ISA >> Conversation: [isalist] SMTP Connection Closed >> Subject: [isalist] Re: SMTP Connection Closed >> >> http://www.ISAserver.org >> ------------------------------------------------------- >> >> What actually happens when the telnet session is initiated? >> Do you see >> anything? Any connect at all? >> >> t >> >> >> On 1/18/07 6:10 PM, "ISA" <ISA@xxxxxxxxxxxxxxxx> spoketh to all: >> >>> http://www.ISAserver.org >>> ------------------------------------------------------- >>> >>> Thanks guys - I'll follow the article is see what goes - >>> >>> Did anyone have any problems actually connecting? >>> >>> I also thought of MTU issues. Two of the sites that can not connect; >> one >>> is fronted with a SonicWall, the other a Linksys (stop, >> don't even say >>> it... I know). >>> >>> >>> >>> Joseph Danielsen, MCSA-Messaging, MCP >>> >>> -----Original Message----- >>> From: isalist-bounce@xxxxxxxxxxxxx >> [mailto:isalist-bounce@xxxxxxxxxxxxx] >>> On Behalf Of Greg Mulholland >>> Posted At: Thursday, January 18, 2007 8:58 PM >>> Posted To: ISA >>> Conversation: [isalist] Re: SMTP Connection Closed >>> Subject: [isalist] Re: SMTP Connection Closed >>> >>> http://www.ISAserver.org >>> ------------------------------------------------------- >>> >>> I'm wondering if he is experiencing any other signs of >> flaky internet >>> connection. Like in browsing etc etc. Ive seen mtu issues do this. >>> >>> Greg >>> ----- Original Message ----- >>> From: "Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx> >>> To: <isalist@xxxxxxxxxxxxx> >>> Sent: Friday, January 19, 2007 12:49 PM >>> Subject: [isalist] Re: SMTP Connection Closed >>> >>> >>>> http://www.ISAserver.org >>>> ------------------------------------------------------- >>>> >>>> But that wouldn't have anything at all to do with telnetting to 25, >>> which >>>> I >>>> can do, but I now see that others cannot. A blacklist or etc will >> not >>>> affect that. >>>> >>>> t >>>> >>>> >>>> On 1/18/07 4:29 PM, "Amy Babinchak" >> <amy@xxxxxxxxxxxxxxxxxxxxxxxxxx> >>>> spoketh >>>> to all: >>>> >>>>> It only effects incoming email. >>>>> >>>>> You can get around it by using a smarthost. Your cable company >>> probably >>>>> allows >>>>> you to use their server for such purpose. That's how I get around >> it. >>>>> >>>>> ________________________________ >>>>> >>>>> From: isalist-bounce@xxxxxxxxxxxxx on behalf of ISA >>>>> Sent: Thu 1/18/2007 7:22 PM >>>>> To: isalist@xxxxxxxxxxxxx >>>>> Subject: [isalist] SMTP Connection Closed >>>>> >>>>> >>>>> I thought that would affect my outgoing mail - not incoming! >>>>> >>>>> <unfortunately I can't get a static IP for another few months, I >> will >>> >>>>> then> >>>>> >>>>> Joseph Danielsen, MCSA-Messaging, MCP >>>>> Network Blade Inc. >>>>> 49 Marcy Street >>>>> Somerset, NJ 08873 >>>>> 732-213-0600 >>>>> www.networkblade.com <http://www.networkblade.com/> >>>>> >>>>> >>>>> >>> >> <https://harbor.bounceme.net/Exchange/amy/Drafts/RE:%20[isalis >> t]%20SMTP% >>> 20Conn >>>>> ection%20Closed.EML/1_multipart/image001.jpg> >>>>> >>> >> <https://harbor.bounceme.net/Exchange/amy/Drafts/RE:%20[isalis >> t]%20SMTP% >>> 20Conn >>>>> ection%20Closed.EML/1_multipart/image002.jpg> >>>>> ________________________________ >>>>> >>>>> From: isalist-bounce@xxxxxxxxxxxxx >>> [mailto:isalist-bounce@xxxxxxxxxxxxx] >>>>> On >>>>> Behalf Of Amy Babinchak >>>>> Sent: Thursday, January 18, 2007 7:20 PM >>>>> To: isalist@xxxxxxxxxxxxx >>>>> Subject: RE: [isalist] SMTP Connection Closed >>>>> >>>>> according to dsnstuff.com you are listed on 3 blacklists >> and have no >>>>> reverse >>>>> DNS entry. That's enough right there to cause you to have >>> inconsistant >>>>> incoming email issues. >>>>> >>>>> ________________________________ >>>>> >>>>> From: isalist-bounce@xxxxxxxxxxxxx on behalf of ISA >>>>> Sent: Thu 1/18/2007 7:06 PM >>>>> To: isalist@xxxxxxxxxxxxx >>>>> Subject: [isalist] SMTP Connection Closed >>>>> Amy: >>>>> DNS seems to be working (mail.networkblade.com resolves to the >>> correct >>>>> IP), >>>>> "I" am not blacklisting and I don't know how to Grey list. >>>>> >>>>> The ISP (cable company) is always suspect of everything else. >>>>> >>>>> Joseph Danielsen, MCSA-Messaging, MCP >>>>> Network Blade Inc. >>>>> 49 Marcy Street >>>>> Somerset, NJ 08873 >>>>> 732-213-0600 >>>>> ________________________________ >>>>> >>>>> From: isalist-bounce@xxxxxxxxxxxxx >>> [mailto:isalist-bounce@xxxxxxxxxxxxx] >>>>> On >>>>> Behalf Of Amy Babinchak >>>>> Sent: Thursday, January 18, 2007 7:02 PM >>>>> To: isalist@xxxxxxxxxxxxx >>>>> Subject: RE: [isalist] SMTP Connection Closed >>>>> >>>>> So assuming that this used to work you've eliminated the other >>> obvious >>>>> things >>>>> besides filtering like bad DNS, flakey ISP, blacklisting, grey >>> listing, >>>>> etc? >>>>> >>>>> ________________________________ >>>>> >>>>> From: isalist-bounce@xxxxxxxxxxxxx on behalf of ISA >>>>> Sent: Thu 1/18/2007 6:46 PM >>>>> To: isalist@xxxxxxxxxxxxx >>>>> Subject: [isalist] SMTP Connection Closed >>>>> Good questions! >>>>> Thor: I was referring to Exchange filtering NOT ISA. I >> was not aware >>> of >>>>> the >>>>> NOOP config in the SMTP filter properties. >>>>> Amy: By client I mean another account with a separate ISP and >>> Exchange >>>>> server >>>>> somewhere else in the world. i.e. NJ. >>>>> >>>>> Joseph Danielsen, MCSA-Messaging, MCP >>>>> Network Blade Inc. >>>>> 49 Marcy Street >>>>> Somerset, NJ 08873 >>>>> 732-213-0600 >>>>> www.networkblade.com <http://www.networkblade.com/> >>>>> >>>>> >>>>> >>> >> <https://harbor.bounceme.net/Exchange/amy/Drafts/RE:%20[isalis >> t]%20SMTP% >>> 20Conn >>>>> ection%20Closed.EML/1_multipart/%20> >>>>> >>> >> <https://harbor.bounceme.net/Exchange/amy/Drafts/RE:%20[isalis >> t]%20SMTP% >>> 20Conn >>>>> ection%20Closed.EML/1_multipart/%20> >>>>> ________________________________ >>>>> >>>>> From: isalist-bounce@xxxxxxxxxxxxx >>> [mailto:isalist-bounce@xxxxxxxxxxxxx] >>>>> On >>>>> Behalf Of Thor (Hammer of God) >>>>> Posted At: Thursday, January 18, 2007 6:40 PM >>>>> Posted To: ISA >>>>> Conversation: [isalist] SMTP Connection Closed >>>>> Subject: [isalist] Re: SMTP Connection Closed >>>>> >>>>> Just to make sure we're saying the same thing.. Not filtering via >>>>> Exchange and >>>>> 3rd party- the ISA SMTP filter. You disabled that? >>>>> >>>>> t >>>>> >>>>> >>>>> On 1/18/07 3:30 PM, "ISA" <ISA@xxxxxxxxxxxxxxxx> spoketh to all: >>>>> Thor - thanks but I've turned off ALL filtering via >> Exchange and 3rd >>>>> party >>>>> software. >>>>> >>>>> I've tried connecting (via telnet) from multiple >> locations (ISP) and >>> from >>>>> Exchange 2003 and SBS 2003. Some work and Some don't. >> When watching >>> the >>>>> ISA >>>>> real-time logs, the connection is initiated then 5 >> seconds later it >>> is >>>>> then >>>>> closed by the Exchange publishing rule. >>>>> >>>>> A 12-pack for the one who gets this one! >>>>> >>>>> <and this is on my own server/network> >>>>> >>>>> >>>>> Joseph Danielsen, MCSA-Messaging, MCP >>>>> Network Blade Inc. >>>>> 49 Marcy Street >>>>> Somerset, NJ 08873 >>>>> 732-213-0600 >>>>> www.networkblade.com <http://www.networkblade.com/> >>>>> <http://www.networkblade.com/> >>>>> >>>>> >>>>> >>> >> <https://harbor.bounceme.net/Exchange/amy/Drafts/RE:%20[isalis >> t]%20SMTP% >>> 20Conn >>>>> ection%20Closed.EML/1_multipart/%20> >>>>> >>> >> <https://harbor.bounceme.net/Exchange/amy/Drafts/RE:%20[isalis >> t]%20SMTP% >>> 20Conn >>>>> ection%20Closed.EML/1_multipart/%20> >>>>> ________________________________ >>>>> >>>>> From: isalist-bounce@xxxxxxxxxxxxx >>> [mailto:isalist-bounce@xxxxxxxxxxxxx] >>>>> <mailto:isalist-bounce@xxxxxxxxxxxxx%5d> On Behalf Of >> Thor (Hammer >>> of >>>>> God) >>>>> Posted At: Thursday, January 18, 2007 6:22 PM >>>>> Posted To: ISA >>>>> Conversation: [isalist] SMTP Connection Closed >>>>> Subject: [isalist] Re: SMTP Connection Closed >>>>> >>>>> Check your SMTP filter settings for command lengths... >> NOOP has been >>>>> problematic before at its default of 6 - I changed mine >> to 20 after >>>>> sniffing >>>>> traffic and determining some older Exchange boxes were >> padding NOOP >>> with >>>>> spaces.. >>>>> >>>>> t >>>>> >>>>> >>>>> On 1/18/07 1:46 PM, "ISA" <ISA@xxxxxxxxxxxxxxxx> spoketh to all: >>>>> Hope someone can help! >>>>> >>>>> I think this is an ISA 2004 (patched) issue. >>>>> >>>>> From some clients I can send/receive email just fine (and telnet >> port >>> >>>>> 25). But >>>>> from other clients I can not. I monitored the ISA logs >> and observed >>> the >>>>> connection initiated then being closed. >>>>> >>>>> From Exchange 2003 box I shut of IMF and GFI services - still not >>> luck >>>>> receiving email or telnet'ing from a particular client. >>>>> >>>>> Any ideas would be greatly appreciated. >>>>> >>>>> Respectfully >>>>> >>>>> >>>>> Joseph Danielsen, MCSA-Messaging, MCP >>>>> Network Blade Inc. >>>>> 49 Marcy Street >>>>> Somerset, NJ 0887 >>>>> 732-213-0600 >>>>> >>>> >>>> >>>> ------------------------------------------------------ >>>> List Archives: //www.freelists.org/archives/isalist/ >>>> ISA Server Newsletter: >> http://www.isaserver.org/pages/newsletter.asp >>>> ISA Server Articles and Tutorials: >>>> http://www.isaserver.org/articles_tutorials/ >>>> ISA Server Blogs: http://blogs.isaserver.org/ >>>> ------------------------------------------------------ >>>> Visit TechGenix.com for more information about our other sites: >>>> http://www.techgenix.com >>>> ------------------------------------------------------ >>>> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp >>>> Report abuse to listadmin@xxxxxxxxxxxxx >>>> >>>> >>> >>> ------------------------------------------------------ >>> List Archives: //www.freelists.org/archives/isalist/ >>> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp >>> ISA Server Articles and Tutorials: >>> http://www.isaserver.org/articles_tutorials/ >>> ISA Server Blogs: http://blogs.isaserver.org/ >>> ------------------------------------------------------ >>> Visit TechGenix.com for more information about our other sites: >>> http://www.techgenix.com >>> ------------------------------------------------------ >>> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp >>> Report abuse to listadmin@xxxxxxxxxxxxx >>> >>> ------------------------------------------------------ >>> List Archives: //www.freelists.org/archives/isalist/ >>> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp >>> ISA Server Articles and Tutorials: >>> http://www.isaserver.org/articles_tutorials/ >>> ISA Server Blogs: http://blogs.isaserver.org/ >>> ------------------------------------------------------ >>> Visit TechGenix.com for more information about our other sites: >>> http://www.techgenix.com >>> ------------------------------------------------------ >>> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp >>> Report abuse to listadmin@xxxxxxxxxxxxx >>> >>> >>> >> >> >> ------------------------------------------------------ >> List Archives: //www.freelists.org/archives/isalist/ >> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp >> ISA Server Articles and Tutorials: >> http://www.isaserver.org/articles_tutorials/ >> ISA Server Blogs: http://blogs.isaserver.org/ >> ------------------------------------------------------ >> Visit TechGenix.com for more information about our other sites: >> http://www.techgenix.com >> ------------------------------------------------------ >> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp >> Report abuse to listadmin@xxxxxxxxxxxxx >> >> ------------------------------------------------------ >> List Archives: //www.freelists.org/archives/isalist/ >> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp >> ISA Server Articles and Tutorials: >> http://www.isaserver.org/articles_tutorials/ >> ISA Server Blogs: http://blogs.isaserver.org/ >> ------------------------------------------------------ >> Visit TechGenix.com for more information about our other sites: >> http://www.techgenix.com >> ------------------------------------------------------ >> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp >> Report abuse to listadmin@xxxxxxxxxxxxx >> >> >> ------------------------------------------------------ >> List Archives: //www.freelists.org/archives/isalist/ >> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp >> ISA Server Articles and Tutorials: >> http://www.isaserver.org/articles_tutorials/ >> ISA Server Blogs: http://blogs.isaserver.org/ >> ------------------------------------------------------ >> Visit TechGenix.com for more information about our other sites: >> http://www.techgenix.com >> ------------------------------------------------------ >> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp >> Report abuse to listadmin@xxxxxxxxxxxxx >> >> ------------------------------------------------------ >> List Archives: //www.freelists.org/archives/isalist/ >> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp >> ISA Server Articles and Tutorials: >> http://www.isaserver.org/articles_tutorials/ >> ISA Server Blogs: http://blogs.isaserver.org/ >> ------------------------------------------------------ >> Visit TechGenix.com for more information about our other sites: >> http://www.techgenix.com >> ------------------------------------------------------ >> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp >> Report abuse to listadmin@xxxxxxxxxxxxx >> >> >> > ------------------------------------------------------ > List Archives: //www.freelists.org/archives/isalist/ > ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp > ISA Server Articles and Tutorials: > http://www.isaserver.org/articles_tutorials/ > ISA Server Blogs: http://blogs.isaserver.org/ > ------------------------------------------------------ > Visit TechGenix.com for more information about our other sites: > http://www.techgenix.com > ------------------------------------------------------ > To unsubscribe visit http://www.isaserver.org/pages/isalist.asp > Report abuse to listadmin@xxxxxxxxxxxxx > > ------------------------------------------------------ > List Archives: //www.freelists.org/archives/isalist/ > ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp > ISA Server Articles and Tutorials: > http://www.isaserver.org/articles_tutorials/ > ISA Server Blogs: http://blogs.isaserver.org/ > ------------------------------------------------------ > Visit TechGenix.com for more information about our other sites: > http://www.techgenix.com > ------------------------------------------------------ > To unsubscribe visit http://www.isaserver.org/pages/isalist.asp > Report abuse to listadmin@xxxxxxxxxxxxx > > > ------------------------------------------------------ List Archives: //www.freelists.org/archives/isalist/ ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server Articles and Tutorials: http://www.isaserver.org/articles_tutorials/ ISA Server Blogs: http://blogs.isaserver.org/ ------------------------------------------------------ Visit TechGenix.com for more information about our other sites: http://www.techgenix.com ------------------------------------------------------ To unsubscribe visit http://www.isaserver.org/pages/isalist.asp Report abuse to listadmin@xxxxxxxxxxxxx