Questions[ironport](server)

I am in the process to migrate to separate Vlans from a single 10.1.0.0/16 subnet on VLAN1

In the existing /16 subnet is our Cisco Mail Security (ESA).

In a new Vlan Segment for clients (10.101.10.0/24, VLAN6 ) I can do pretty much everything but access the ESA. No ping and also no access via HTTP(s). Other servers and services are fully accessible like from VLAN1

The Cisco support said there is no issue on the config for the ESA.

The network is fully Cisco.

Network/IP interfaces setting of ESA:

10.1.30.188/16

I also tried adding a separate NIC with config 10.101.10.250/24, but it did not solve anything

Vlan config on Coreswitch:

show run interface vlan 1
interface Vlan 1
ip address 10.1.0.253 255.255.0.0
end

show run interface vlan 6
!
interface Vlan 6
description LAN-Clients
ip address 10.101.10.253 255.255.255.0
ip helper-address 10.1.30.84
no ip route-cache
end

The FW is a Cisco ASA 5508-X

the problem also applies from VLAN8 test Virtual Machines on same hypervisor. The management of the Cisco ASA is externally managed.

This is a ping test from Coreswitch:

CiscoCORE#ping 10.1.30.188 Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.30.188, timeout is 2 seconds: !!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms

CiscoCORE#ping 10.1.30.188 source vlan8 Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.30.188, timeout is 2 seconds: Packet sent with a source address of 10.8.0.253 .....

Success rate is 0 percent (0/5)

where could be the issue?

Update: thanks to the comment of @Tero Kilkanen I added some infos and tests. I did not think of a possible problem on ASA side yet, but it may be the point to look

Update: I finally did it. Upon re-checking the IP interfaces (I had also created an Interface wiht IP in VLAN6 of course) I tried creating it via SSH (with the same settings)

Afterwards I could access it from Vlan6 Maybe the IP interface has to be created via SSH instead of Web GUI. I did not set anything different

this was just a thought and I wondered if anyone else had managed to do it or thought about it.

We use Google apps for Business and to avoid any issues, we have whitelisted all of Google's IP ranges on our Cisco Ironport. However, some of our users abuse this and spend all day in their own Google mail account. Is it possible to block non corporate Gmail URL's to prevent them from logging in to their own accounts?

I would really like to hear if anyone else has managed to do this or given it any thought. Merry Christmas!

I'am trying to configure my ESA C170 and all works as expected. But now I want to add support for relay function for authed external user. I add a SMTP Auth Profile against LDAP that works. Next Step is to configure HAT and the sender group. If I add the Mail Flow Policy to HAT Relay and add my own IP to Sendergroup than it works but I need for all the internet. What I'am looking for is a rule that allows only authed User from 0.0.0.0/0 to relay and all other should match to accepted if the Address is listed in the transport section. In the manual for the ASYNC OS I found the section "Configuring AsyncOS for SMTP Authentication"

SMTP Authentication and HAT Policy Settings

Because senders are grouped into the appropriate sender group before the SMTP Authentication negotiation begins, Host Access Table (HAT) settings, are not affected. When a remote mail host connects, the appliance first determines which sender group applies and imposes the Mail Policy for that sender group. For example, if a remote MTA “suspicious.com” is in your SUSPECTLIST sender group, the THROTTLE policy will be applied, regardless of the results of “suspicious.com’s” SMTPAUTH negotiation.

However, senders that do authenticate using SMTPAUTH are treated differently than “normal” senders. The connection behavior for successful SMTPAUTH sessions changes to “RELAY,” effectively bypassing the Recipient Access Table (RAT) and LDAPACCEPT. This allows the sender to relay messages through the appliance. As stated, any Rate Limiting or throttling that applies will remain in effect.

I'am searching for the configuration path of "senders that do authenticate using SMTPAUTH are treated differently" but there is nothing like that.

Heres my current HAT if I add my own IP to sender list of sendergroup RELAYLIST than I can see the AUTHMECH in SMTP Dialog. How can I change the Sendergroups to show SMTP AUTH like this

Connected to 192.168.100.3.
Escape character is '^]'.
220 ironport.domain.tld ESMTP
ehlo test
250-ironport.domain.tld
250-8BITMIME
250 SIZE 10485760
250-AUTH PLAIN LOGIN
250 AUTH=PLAIN LOGIN

For all external Users to Login. If I change the senderlist to 0.0.0.0/0 than everyone must authenticate against the iron port so I cannot accept Messages for the own recipients.

My school uses Ironport for filtering/monitoring web traffic. I have a bit of curiosity as to why it tacks on a x-junk: header onto everything. After going through a few curl tests, I've found no real connection between what is shown on the page and the x-junk: header.

here's my curl request: any ideas?

Anchorage:~ khotchkiss$ curl -I google.com
HTTP/1.1 301 Moved Permanently
Location: http://www.google.com/
Content-Type: text/html; charset=UTF-8
Date: Sun, 06 Feb 2011 04:37:25 GMT
Expires: Tue, 08 Mar 2011 04:37:25 GMT
Cache-Control: public, max-age=2592000
Server: gws
X-XSS-Protection: 1; mode=block
Content-Length: 219
Age: 108
Via: 1.1 MC-IRONPORT.UNIVERSITY.LIBERTY.EDU:80 (IronPort-WSA/6.3.3-015)
Connection: keep-alive
X-Junk: xxxxxxxxxxxxxxxxxxxxxxx