Welcome to ISAserver.org

SMTP blocking of invalid IP addresses

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA 2006 Firewall] >> Access Policies >> SMTP blocking of invalid IP addresses

Page: [1]

Message

<< Older Topic Newer Topic >>

SMTP blocking of invalid IP addresses - 1.Dec.2008 1:23:15 PM

Satanmat

Posts: 4
Joined: 15.Aug.2008
Status: offline

We are using ISA 2006 to block inbound SMTP traffic. We use the THOR country sets to block most of the spam coming in.

Now we've had a few leak through (yes very few) but we've spotted a trend that bothers me.

The "X-Originating-IP: [051.7.77.8]" is not valid... Or more accurately as read by a human is correct, but it seems that ISA cannot deal with the understanding that 051.x.x.x should be the same as 51.x.x.x

So, OH WISE and powerful gurus; can you think of a way to handle those few that are trying this trick?

Is there a way to force ISA to drop it if the IP is not valid?

Thanks.

Sean Powell

Post #: 1

Featured Links*

RE: SMTP blocking of invalid IP addresses - 31.Dec.2008 9:37:36 AM

tshinder

Posts: 47659
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Sean,

Interesting find. But isn't X-originating IP in the SMTP message itself?

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to Satanmat)

Post #: 2