Netscreen 50 - SMTP outbound source address

[reg]

Archived from groups: comp.security.firewalls (More info?)

We recently ran across a situation where a web hosting company (SPC
Hosting) is requiring a R-DNS record registered with our ISP in order
to successfully email a domain that uses SPC (the premise is that it
curbs UCE). After confirming that our ISP had entered the pointer
record we were still getting mail kicked by SPC. As it turns out, our
Netscreen logs show the source address in the header as being the
untrusted interface of the ns50 and not the ip of our MX record. Since
the pointer record is configured for our MX record having the source
address appear as a different ip is giving me an ulcer.

The untrusted interface has a VIP mapped to our MX record and a policy
that maps that to the inside interface of the internal SMTP gateway
(ISA Server) so the inbound mail finds the exchange server no problem
but on the way out the address appears to come from something other
than the MX address (which is what SPC is looking for).

How can I configure the Netscreen so that outbound mail is tagged with
the MX address and not the untrust interface address? I can see more
ISPs requiring a pointer record in order to sent through them which
would give my CIO cause to have a full litter of kittens b/c the
outbound will be refused.

If anyone has ran across this or knows a config that will provide the
fix, I'd like to hear about it.

TIA,
Reg

 

[Guest]

Archived from groups: comp.security.firewalls (More info?)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Use a MIP instead of a VIP. A virtual IP addy will always go out as the
untrusted IP addy. A one-to-one mapping will have a different IP associated
with it.

- - -Scott

"Reg" <regedt3200@hotmail.com> wrote in message
news:9ebfba97.0406281731.28183948@posting.google.com...
> We recently ran across a situation where a web hosting company (SPC
> Hosting) is requiring a R-DNS record registered with our ISP in order
> to successfully email a domain that uses SPC (the premise is that it
> curbs UCE). After confirming that our ISP had entered the pointer
> record we were still getting mail kicked by SPC. As it turns out, our
> Netscreen logs show the source address in the header as being the
> untrusted interface of the ns50 and not the ip of our MX record. Since
> the pointer record is configured for our MX record having the source
> address appear as a different ip is giving me an ulcer.
>
> The untrusted interface has a VIP mapped to our MX record and a policy
> that maps that to the inside interface of the internal SMTP gateway
> (ISA Server) so the inbound mail finds the exchange server no problem
> but on the way out the address appears to come from something other
> than the MX address (which is what SPC is looking for).
>
> How can I configure the Netscreen so that outbound mail is tagged with
> the MX address and not the untrust interface address? I can see more
> ISPs requiring a pointer record in order to sent through them which
> would give my CIO cause to have a full litter of kittens b/c the
> outbound will be refused.
>
> If anyone has ran across this or knows a config that will provide the
> fix, I'd like to hear about it.
>
> TIA,
> Reg
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>

iQA/AwUBQODmPeAH+KdEQeVvEQKdAACgmvkXoJWQ2P6p0O520YyfWMJFMUoAn0Cn
QUTJftuncYV+ddAw79a1bBgD
=bC7s
-----END PGP SIGNATURE-----

 

[Guest]

Archived from groups: comp.security.firewalls (More info?)

Hi,

Reg <regedt3200@hotmail.com> wrote:
> If anyone has ran across this or knows a config that will provide the
> fix, I'd like to hear about it.

As a fast fix: Enter the Netscreen interface address into the rDNS.

 

[Alec]

Archived from groups: comp.security.firewalls (More info?)

"SA" <localhost@null.xxx> wrote in message
news:ME5Ec.108887$2i5.101557@attbi_s52...
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Use a MIP instead of a VIP. A virtual IP addy will always go out as the
> untrusted IP addy. A one-to-one mapping will have a different IP
associated
> with it.
>
> - - -Scott

I second Scott's advice. A VIP is an inbound only mapping. Basically, VIP's
are for people that don't have enough public IPs to support the services
they want to expose publicly. A MIP is a bi-directional mapping. A MIP is
what you want.

Alec