smtp routing mystery
hiyesterday we had a networking engineer come in to analyse the policies on our watchguard m400 firewall.as part of that some redundant, or duplicate, policies were disabled.now what's happening that is anonymous smtp traffic isn't getting delivered and the queues are building up.if i look at the wg firewall monitor i see deny events caused by the block-all policy. that this policy is last in the list suggests that not even our exchange online policy is picking up and passing the traffic.i've checked that policy and as far as i can see it it should be allowing the traffic.i'm far from a networking expert so here i am, begging for help again!help, please!
just a note to say this is resolved.one thing i'd not realised was that a policy doesn't take effect until 'save...to firebox' is selected. (smh)anyway, the original engineer got back in contact and reckons that the original policy that should have been handling the traffic (the one in the screenshots above) had too many destination choices in it, such that the firebox got confused and couldn't find the match, then moved on to the rest of the policies until it got to the end (block-all).he reckons this is an issue with the version of the os our firewall is running but is fixed in the new version.what's handling the traffic now is a new policy that accepts smtp traffic on port 25 from our server to any-external address.thanks all for your responses.
Hi [@MathewRD](/t5/user/viewprofilepage/user-id/112936) .

 

when the tcp handshake is initiated for any application the firewall will view all policies for an explicit allow. If none are available then it will check again for any implicit allows.

 

i found these links helpful.

<https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLLICA4>

 

<https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClV0CAK>

 




[View solution in original post](/t5/general-topics/implicit-applications-with-cotp-ms-rdp-in-security-policies/m-p/294040#M77643) Dear Jay Nelish


Your Question is incomplete


is the specific system is not on Network? its might be a problem discovered last year, that system ping but not share any data, or cannot access the system


you click on start menu and then click on run  

type serivces.msc  

and run the computer browser service, Remote Procedure call service, Server, and Client service


and your problem will resolved  

but actually this is because of virus change your antivirus program and scan your system wtih updated A/V Techburner,Found we were missing firewall whitelistings for a couple urls, adding them has resolved this issue for those users who have refreshed their policies. In the server configuration document, in the Router/SMTP section, tab Restrictions and controls|SMTP Outbound controls, there is a parameter ‘Allow messages only from the following Notes addresses to be sent to the Internet:’. List the allowed names there, to prevent the others from sending mail to the Internet. updated on 26/02/2021:this sounds like an 'erroneous transfer' to me,@oldboiler - more info on this topic!i would reach out to our customer care team asap.we’re onfacebook,twitterand ourhelp centrehasonline chat!we can find out who is trying to take over your supply, so you can approach them and advise you wish to cancel, or highlight they have the wrong address.if it's too late or you can't cancel with them, we can 'object' to this switch, blocking it from happening!if you’re reading this and you’re thinking of switching suppliers, head over to our quote and switch page hereand check out our latest plans. hi, i think i was able to isolate the issue to flights dispatched via the simbrief api.

it should be fixed now, let me know if you still have the issue in future flights.

thanks, welcome rm.  the smtp server listed in the post is the correct one.  the is a short time lag between account creation and full activation on the server. please retry the outlook set up again and let us know if it successful. 
 
thank you Otherway, if there is an Active session exist on the firewall, you may grab the session ID and see detailed info as mentioned below:

> show session all filter source x.x.x.x destination y.y.y.y

**9936**         dns            ACTIVE  FLOW  NS   100.100.100.1[53621]/trust-L3/17  (1.1.1.2[43506])

vsys1                                          8.8.8.4[53]/untrust-L3  (8.8.8.4[53])

admin@31-PA-3020> show session id 9936

Session            9936

        c2s flow:

                source:      100.100.100.1 [trust-L3]

                dst:         8.8.8.4

                proto:       17

                sport:       53621           dport:      53

                state:       ACTIVE          type:       FLOW

                src user:    plano2003\csharma  >>>>>>>>>>>>>>> Source User

                dst user:    unknown

        s2c flow:

                source:      8.8.8.4 [untrust-L3]

                dst:         1.1.1.2

                proto:       17

                sport:       53              dport:      43506

                state:       ACTIVE          type:       FLOW

                src user:    unknown

                dst user:    plano2003\csharma

        start time                    : Thu Jul 24 12:33:04 2014

        timeout                       : 30 sec

        time to live                  : 12 sec

        total byte count(c2s)         : 240

        total byte count(s2c)         : 0

        layer7 packet count(c2s)      : 3

        layer7 packet count(s2c)      : 0

        vsys                          : vsys1

        application                   : dns

        rule                          : trust-to-untrust  >>>>>>> Security rule

        session to be logged at end   : True

        session in session ager       : True

        session synced from HA peer   : False

        address/port translation      : source + destination

        nat-rule                      : nat-inside-2-outside(vsys1) >>>>>>>>>>>>>> NAT policy name

        layer7 processing             : enabled

        URL filtering enabled         : True

        URL category                  : any

        session via syn-cookies       : False

        session terminated on host    : False

        session traverses tunnel      : True

        captive portal session        : False

        ingress interface             : tunnel.1  >>>>>>>>>>>>>> Incoming interface

        egress interface              : ethernet1/3  >>>>>>>>>>>>>>>> Outgoing interface

        session QoS rule              : N/A (class 4)

Thanks




[View solution in original post](/t5/general-topics/logs/m-p/33969#M24908) they were probably looking at your profile to "check up" on youim ashamed to admit it but i did it with my ex and immediately regretted it, i re-blocked him as soon as i could tho, so i guess check to see if they reblock you in 48 hours and that will be a dead giveaway that they just reblocked you to check up on you strangely enough it did in a strange way. i reinstalled, set up everything again from scratch (agents too) and got the same ‘not connected’ error.

i got frustrated and left it overnight.

the following morning in the office i checked and it discovered both services!

so i guess you could close this…