• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

SMTP alerts not working when IIS SMTP and ISA on separate machines

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2000 General] >> Server Publishing >> SMTP alerts not working when IIS SMTP and ISA on separate machines Page: [1]
Login
Message << Older Topic   Newer Topic >>
SMTP alerts not working when IIS SMTP and ISA on separa... - 29.May2002 2:25:00 PM   
nathan

 

Posts: 21
Joined: 13.Mar.2001
From: Clifton Springs, Vic, Australia
Status: offline
Hi,

I have installed the SMTP filter onto a separate server as mentioned in Tom's article "Setting up the Message Screener for Bidirectional Mail Traffic".

Everything works fine. ISA is on it own box. The IIS SMTP server that has the filter installed and relays to our Notes server which in turn waits for the clients to retrieve their mail.

Mail is stopped or forwarded (depending on the rule) if it contains the wrong words or denied attachments.

The only problem is that the alerts are never triggered if a rule is broken and the NT Event log never shows that a rule has been broken. But when the TEST button is pressed in the SMTP Alert setup I receive the mail as normal. And the rule is definately enabled.

I am sure from past experience that when the IIS SMTP and ISA were installed onto the same machine these alerts were triggered when a rule was broken.

Could there be any difference when the IIS SMTP and ISA are installed onto separate machines?

Any help with this problem will be greatly appreciated.

TIA

Nathan Simpson
nathan@awh.com.au

[ May 29, 2002, 02:32 PM: Message edited by: nathan ]
Post #: 1
RE: SMTP alerts not working when IIS SMTP and ISA on se... - 29.May2002 8:33:00 PM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Nathan,

Hmmm. That's a good question. I know there's no problem getting Alerts in the logs for the SMTP filter, but I've never looked in the logs for the Message Screener. I just look in the badmail folder [Big Grin]

If you test this out again, let us know what your findings are.

Thanks!

Tom

(in reply to nathan)
Post #: 2
RE: SMTP alerts not working when IIS SMTP and ISA on se... - 30.May2002 5:34:00 AM   
nathan

 

Posts: 21
Joined: 13.Mar.2001
From: Clifton Springs, Vic, Australia
Status: offline
Tom,

I don't get any reports of SMTP failures anywhere. Not in the ISA server itself under Monitor | Alerts. Not in the Event log of the ISA Server or the IIS SMTP server or as a SMTP mail.

As I said pressing the test button works fine.

The funny thing is, is the SMTP filter is working fine and doing everything it supposed to be doing.

I look forward to any other information you may have.

Regards,

Nathan
nathan@awh.com.au

(in reply to nathan)
Post #: 3
RE: SMTP alerts not working when IIS SMTP and ISA on se... - 30.May2002 6:37:00 PM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Nathan,

The only info I get regarding SMTP filter alerts is when someone is trying a buffer overflow attack on my servers. I've never seen an alert regarding a "caught spam". You can configure these kind of alerts with GFI's MailSecurity, though.

HTH,
Tom

(in reply to nathan)
Post #: 4
RE: SMTP alerts not working when IIS SMTP and ISA on se... - 1.Jun.2002 7:25:00 AM   
nathan

 

Posts: 21
Joined: 13.Mar.2001
From: Clifton Springs, Vic, Australia
Status: offline
Hi Tom,

So my memory of recieving an email when someone breaks an SMTP Filter rule such as bad attachment from the SMTP Alert is just a false memory.

So what does the SMTP Filter alert do. The description text says that it warns of SMTP commands being broken. Is this the case? If so, how can I test it? How can I send a bad SMTP command to the IIS SMTP server?

TIA

Nathan

(in reply to nathan)
Post #: 5
RE: SMTP alerts not working when IIS SMTP and ISA on se... - 1.Jun.2002 7:28:00 AM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Nathan,

The buffer overflow attacks are violations of the SMTP filter settings, based on the commands and command lengths configured in the SMTP filter. If you get a message containing one of these commands that exceeds the length, or if you get a command like NOOP (which isn't included by default), then you'll get a notification.

SMTP Message Screen violations don't appear in the Alerts (at least I don't recall them being reported).

HTH,
Tom

(in reply to nathan)
Post #: 6
RE: SMTP alerts not working when IIS SMTP and ISA on se... - 1.Jun.2002 7:45:00 AM   
nathan

 

Posts: 21
Joined: 13.Mar.2001
From: Clifton Springs, Vic, Australia
Status: offline
Good morning Tom,

You are up very early for a Saturday morning.

You should be sleeping in. That is what I tried to do this morning. And luckily my daughter had the same thing in mind.

Thanks again for the info and your help.

Regards,

Nathan

(in reply to nathan)
Post #: 7
RE: SMTP alerts not working when IIS SMTP and ISA on se... - 24.Jun.2002 8:29:00 PM   
Xuser

 

Posts: 232
Joined: 29.Jan.2002
From: Canada
Status: offline
quote:
Originally posted by tshinder:
Hi Nathan,

The buffer overflow attacks are violations of the SMTP filter settings, based on the commands and command lengths configured in the SMTP filter. If you get a message containing one of these commands that exceeds the length, or if you get a command like NOOP (which isn't included by default), then you'll get a notification.

SMTP Message Screen violations don't appear in the Alerts (at least I don't recall them being reported).

HTH,
Tom

Hi Tom, actually when I setup my Message Screener according to your instructions, the Noop is already there by default. Not sure why you said it is not there by default??? Anyhow, is there any side affect when I disabled only the SMTP Command filters? The reason I asked is because I did just that and now, all inbound e-mails have stopped.

(in reply to nathan)
Post #: 8

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2000 General] >> Server Publishing >> SMTP alerts not working when IIS SMTP and ISA on separate machines Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts