Once the failed login limit is reached, the Kerio Connect blocks the IP address, which makes it impossible for devices (Apple macOS) to log in. See Cisco Firewall disabling TLS initiation by default and Allow TLS through ASA / PIX (SMTP fixup/ESMTP application inspection) for more on other ways to fix this.Kerio Connect has a built-in AntiHammering security feature that protects from frequent SMTP logins by suspicious IP addresses. Newer PIX versions allow you to make an exception for TLS, but with the older versions your only choice is to shut off the fixup (or have no TLS mail). If you have a PIX Firewall, this is definitely something you should look at.Ĭisco interferes with this because the encryption interferes with its ability to inspect packets - it can't tell what danger might be included. You can turn it off with a simple "no fixup protocol smtp 25" in the Cisco config, so my customer tried that. Apparently Cisco PIX has this "Mailguard" fixup protocol that can cause all kinds of strange problems. When I first looked at that, I thought it couldn't be the problem, but the key is the word "may" in the sentence that says "You may experience one or more of the following behaviors:". He then referred us to this Microsoft Knowledgebase article titled "Cannot send or receive e-mail messages behind a Cisco PIX firewall". That engineer poked about and asked a few questions and then said "Oh, wait: I bet I know. It didn't take too much work to show that this was not the case, so we got the ticket escalated.
The initial response was very similar to my own: it must be working. I poked around a bit but couldn't figure anything out, so we bounced it on up to Kerio support. As far as I could see, there was no attempt to do this at all. So, we dug into the logs on our side and, sure enough, no encryption was taking place. As both my client and his customer are in the medical field and have to be concerned with HIPAA and other privacy regulations, and as the email that they were sending each other could contain personal information about patients, this was a serious problem. I aked how he knew that and found that a customer of his had noticed this in their mail logs. "Then you should be all set", I insisted.Īhh. I asked him to see if "Use SSL if supported by remote SMTP server" was checked as shown below. I asked him to take a look in the SMTP Server section of his Kerio configuration, specifically under the SMTP Delivery tab.
"I'm pretty sure I would have set you up that way originally - maybe something changed?". "It should just happen automatically as long as both the sending and the receiving server recognize STARTTLS." After exchanging pleasantries, my customer asked "Say, why don't we do TLS?" Cisco PIX interferes with TLS (encrypted) EmailĪ few weeks back I had a call from one of my larger Kerio clients.
0 kommentar(er)
