New Member

Question

Blocked port 25 on fortigate 60c

Forum|Forum|11 years ago
February 7, 2015
34 replies
54009 views

Hello to all members

I have big problem with fortigate blocking port 25 I hope that someone will me able to help me. Since mail service is crucial for our company this is big problem for me.

I have mail server which s on interface 4 (basically DMZ interface) with let say address 10.10.10.1. VIP group is created and contains port forwarding for all necessary services for mail server SMTP(25), SMTPS(465), POP3S(995), IMAPS(993), NNTPS(563), HTTPS(443). Users are on interface 1.

Policy are in place

internal1 -->internal4

internal1 --> WAN2

internal4 -->WAN2

WAN2 --> internal4

set srcintf "wan2" set dstintf "internal4" set srcaddr "all" set dstaddr "msgroupvip" set action accept set schedule "always" set service "ALL" set logtraffic all

where msgroupvip is VIP group containing fort forwarding for all necessary service.

Problem is with fortigate unit block port 25 (SMTP) from my external address (WAN 2 interface) to local interface - Mail server (Internal 4 interface), Because of that my company is unable to receive any email from external address for past two days. We are able to send email outside and receive and send emails within company internally (Local traffic) . Same issue happens about month ago. Problem resolved itself without my intervention. I was unable to determine what cause this problem. Yesterday problem arise again. Again port 25 on fortigate is blocked. All other port on VIP who forward traffic to mail server works without problem. All forwarded ports (SMTPS, HTTPS, NNTPS, IMAPS, POP3S) works as they should and only SMTP port is blocked. UTM feature is disabled. As far I know no attack is detected on our network and every other service works as they should except blocked port 25. Folowing instruction in some other post I even recreated VIP port forwarding for all port again with no results. I even recreated a policy rule for WAN2 --> Internal4 policy with CLI with no result.

Firmware version is v5.0,build0305 (GA Patch 10). While we where on firmware 4.0 MR3 we never experienced this problem.

Sorry for the long post but I try to explain problem in detail.

5.0

Dave_Hall

New Member

Can you post a screenshot of the VIP for the port 25 forward?

oberguruAuthor

New Member

Hello

Thank you for your response.

External address has been changed.

VIP_SMTP.jpg

ede_pfau

SuperUser

hello Oberguru,

could you please clarify: at the moment you have an isolated policy for port 25 alone, with the VIP as posted? If not, I would recommend to isolate this particular traffic from the other (xxxS, IMAP, POP3) as the latter is OK.

Then you can make use of some diagnostics. First, configure the policy table display to include the "Count" field. This shows roughly that the policy is hit at all (> 0 bytes). You can reset the count at any time by right clicking and choosing the option to do so in the context menu.

Next, are you familiar with the CLI? Get a command line to the FGT either using the Console widget (detach it if you like), or by using an ssh client (Putty or whatever) to the internal1 interface (well, depending where your PC is connected to, it really doesn't matter much). The ssh client allows you to open a number of command lines, each showing different traffic or being used for command input.

In the CLI, let's see if SMTP is coming in and where it is routed to:

diag deb ena

diag sniffer packet any 'port 25' 4 0 a If you generate an SMTP request you should see traffic coming in on one interface and being routed to internal4. Post the screen output if possible (not as a picture, just copy the text from the CLI).

To generate SMTP traffic (fake traffic) you can enter

telnet <IP of mailserver> 25

You should at least see a 'HELO' if you can reach the mailserver at all.

Next step would be to follow the packet flow through the interfaces, routing and policy. That's what 'diag deb flow' is for. You can get many (many many) examples of it's usage from the forums (search for 'flow' or just for 'emnoc' :-))

Post the output from this, it will clearly show where the traffic stops and why.

I always wonder who installed the FGT in your company, and left you in the ditch - the Fortinet dealer should be at your side in a situation like this. At least this is how I understand my relation with my customers. For a professional this should be solvable in a matter of hours, not days.

oberguruAuthor

New Member

Hello

Thank you ede_pfau for your quick response.

Beleive or not, this fortinet equipment was bought by my predecessors in company and dealer was just deliver this equipment without any installation whatsoever. Upon my arrival in company we did some reconstruction in IT infrastructure and this equipment is used for that. I did all configuration (we have pretty big network system), and even i can say that I am fairly experienced I never before dealt with fortinet equipment and this is first major problem that I have. .

OK, now back to problem. All VIP for particular port forwarding are grouped in one group (msgroupvip).and then associated with policy WAN2 --> internal4.

I will isolate policy only for SMTP VIP and do diagnostic as stated in your post. After that result will be posted. (I can handle CLI so that should't be problem)

Just to clarify things, local delivery (sending and receiving) of mail is ok and port 25 is accessible on local network. Problem exist only when

mail is sent from outside. (Mail server is on private subnet)

oberguruAuthor

New Member

Hello

as ede_pfau suggested two separete policy are created.

1. WAN2 ---> internal4

Incoming interface: WAN2

Source address: all

Outgoing interface: internal4 (Mail server)

Destination address: vipsmtp ---> VIP for SMTP port forwarding

Schedule: always

Service : ALL

2. WAN2 --->internal4

Incoming interface: WAN2

Source address: all

Outgoing interface: internal4 (Mail server)

Destination address: msgroupvip ---> VIP group for all other service port forwarding

Schedule: always

Service : ALL

As I can see Traffic doesn't hit policy 1 with SMTP and Count is always 0 on that policy. all other policy are ok and have traffic.

Result for

diag deb ena diag sniffer packet any 'port 25' 4 0 a.

When I do telnet <public address:25> nothing happend (telnet from outside)

When I do telnet <private address:25> partial output is

d=13 trace_id=20 func=print_pkt_detail line=4311 msg="vd-root received a packet(proto=6, 192.168.2.40:16552->192.168.210.2:25) from Roaming_0. flag , seq 2995053520, ack 0, win 8192"
id=13 trace_id=20 func=init_ip_session_common line=4467 msg="allocate a new session-0005d2e8"
id=13 trace_id=20 func=vf_ip4_route_input line=1600 msg="find a route: flags=00000000 gw-192.168.210.2 via internal4"
id=13 trace_id=20 func=fw_forward_handler line=685 msg="Allowed by Policy-20:"
id=13 trace_id=21 func=print_pkt_detail line=4311 msg="vd-root received a packet(proto=6, 192.168.210.2:25->192.168.2.40:16552) from internal4. flag [S.], seq 2802949049, ack 2995053521, win 14600"
id=13 trace_id=21 func=resolve_ip_tuple_fast line=4370 msg="Find an existing session, id-0005d2e8, reply direction"
id=13 trace_id=21 func=vf_ip4_route_input line=1600 msg="find a route: flags=00000000 gw-192.168.2.40 via Roaming_0"
id=13 trace_id=21 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interface-Roaming_0"
id=13 trace_id=21 func=esp_output4 line=885 msg="encrypting, and send to xx.xx.xx.xxx with source xx.xx.xx.xxx"
id=13 trace_id=21 func=ipsec_output_finish line=231 msg="send to xx.xx.xx.xxx via intf-wan2"
id=13 trace_id=22 func=print_pkt_detail line=4311 msg="vd-root received a packet(proto=6, 192.168.2.40:16552->192.168.210.2:25) from Roaming_0. flag [.], seq 2995053521, ack 2802949050, win 260"

Result for

diag debug flow filter addr x.x.x.x diag debug flow filter proto 6 diag debug flow filter port 25 diag debug flow show console enable diag debug flow trace start 1000 diag debug enable

When I do telnet <public address:25> nothing happend (telnet from outside)

When I do telnet <private address:25> partial output is

id=13 trace_id=58 func=print_pkt_detail line=4311 msg="vd-root received a packet(proto=6, 192.168.2.40:17924->192.168.210.2:25) from Roaming_0. flag , seq 714046965, ack 0, win 8192"
id=13 trace_id=58 func=init_ip_session_common line=4467 msg="allocate a new session-0005f7de"
id=13 trace_id=58 func=vf_ip4_route_input line=1600 msg="find a route: flags=00000000 gw-192.168.210.2 via internal4"
id=13 trace_id=58 func=fw_forward_handler line=685 msg="Allowed by Policy-20:"
id=13 trace_id=59 func=print_pkt_detail line=4311 msg="vd-root received a packet(proto=6, 192.168.210.2:25->192.168.2.40:17924) from internal4. flag [S.], seq 4075275284, ack 714046966, win 14600"
id=13 trace_id=59 func=resolve_ip_tuple_fast line=4370 msg="Find an existing session, id-0005f7de, reply direction"
id=13 trace_id=59 func=vf_ip4_route_input line=1600 msg="find a route: flags=00000000 gw-192.168.2.40 via Roaming_0"
id=13 trace_id=59 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interface-Roaming_0"
id=13 trace_id=59 func=esp_output4 line=885 msg="encrypting, and send to xxx.xxx.xxx.xxx with source xxx.xxx.xxx.xxx"
id=13 trace_id=59 func=ipsec_output_finish line=231 msg="send to xxx.xxx.xxx.xxx via intf-wan2"
id=13 trace_id=60 func=print_pkt_detail line=4311 msg="vd-root received a packet(proto=6, 192.168.2.40:17924->192.168.210.2:25) from Roaming_0. flag [.], seq 714046966, ack 4075275285, win 260"
id=13 trace_id=60 func=resolve_ip_tuple_fast line=4370 msg="Find an existing session, id-0005f7de, original direction"
id=13 trace_id=61 func=print_pkt_detail line=4311 msg="vd-root received a packet(proto=6, 192.168.210.2:25->192.168.2.40:17924) from internal4. flag [.], seq 4075275285, ack 714046966, win 115"

I will be very grateful if someone can help me with this weird problem.

ede_pfau

SuperUser

So you say that from internal1 -> internal4, using a different VIP, you have no problem with SMTP? Only the VIP used on the WAN port does not work?

Besides: would your mailserver respond to the alternative SMTP port as well (587 I think, or was it 465?)? So we could vary the VIP to do port translation in addition to address translation.

In the (far, far) back of my mind I have the suspicion that there once was a problem reported in the forums in which a VIP group was involved, where traffic was blocked when serviced by a VIP group but not when crossing a single VIP.

We'll see.

ede_pfau

SuperUser

Could you please post the sniffer output? You've posted the flow trace twice.

How did you contact the mailserver exactly via telnet?

oberguruAuthor

New Member

I am sorry for that mistake.

Regarding your question:

So you say that from internal1 -> internal4, using a different VIP, you have no problem with SMTP? Only the VIP used on the WAN port does not work?

Yes I have problem only with VIP on the WAN port

After activating

diag deb ena diag sniffer packet any 'port 25' 4 0 a

i do

telnet <xxx.xxx.xxx.xxx> 25 -----> Where xxx.... is fortinet public address . Telnet is done from computer outside company network

telnet 192.168.210.2 25 -----> Where 192... is mail server address on local network (private address). TElnet is done from company network.

Here is the sniffer output:

interfaces=[any]
filters=[port 25]
id=13 trace_id=69 func=print_pkt_detail line=4311 msg="vd-root received a packet (proto=6, 192.168.2.40:22356->192.168.210.2:25) from Roaming_0. flag , seq 23 21302015, ack 0, win 8192"
id=13 trace_id=69 func=init_ip_session_common line=4467 msg="allocate a new sess ion-00064870"
id=13 trace_id=69 func=vf_ip4_route_input line=1600 msg="find a route: flags=000 00000 gw-192.168.210.2 via internal4"
id=13 trace_id=69 func=fw_forward_handler line=685 msg="Allowed by Policy-20:"
id=13 trace_id=70 func=print_pkt_detail line=4311 msg="vd-root received a packet (proto=6, 192.168.210.2:25->192.168.2.40:22356) from internal4. flag [S.], seq 1 533851659, ack 2321302016, win 14600"
id=13 trace_id=70 func=resolve_ip_tuple_fast line=4370 msg="Find an existing ses sion, id-00064870, reply direction"
id=13 trace_id=70 func=vf_ip4_route_input line=1600 msg="find a route: flags=000 00000 gw-192.168.2.40 via Roaming_0"
id=13 trace_id=70 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interf ace-Roaming_0"
id=13 trace_id=70 func=esp_output4 line=885 msg="encrypting, and send to 109.163 .164.237 with source xxx.xxx.xxx.xxx"
id=13 trace_id=70 func=ipsec_output_finish line=231 msg="send to xxx.xxx.xxx.xxx v ia intf-wan2"
2015-02-07 22:39:54.387142 Roaming_0 in 192.168.2.40.22356 -> 192.168.210.2.25: syn 2321302015
2015-02-07 22:39:54.387647 internal4 out 192.168.2.40.22356 -> 192.168.210.2.25: syn 2321302015
2015-02-07 22:39:54.387824 internal4 in 192.168.210.2.25 -> 192.168.2.40.22356: syn 1533851659 ack 2321302016
2015-02-07 22:39:54.388109 Roaming_0 out 192.168.210.2.25 -> 192.168.2.40.22356: syn 1533851659 ack 2321302016
id=13 trace_id=71 func=print_pkt_detail line=4311 msg="vd-root received a packet (proto=6, 192.168.2.40:22356->192.168.210.2:25) from Roaming_0. flag [.], seq 23 21302016, ack 1533851660, win 260"
id=13 trace_id=71 func=resolve_ip_tuple_fast line=4370 msg="Find an existing ses sion, id-00064870, original direction"
id=13 trace_id=72 func=print_pkt_detail line=4311 msg="vd-root received a packet (proto=6, 192.168.210.2:25->192.168.2.40:22356) from internal4. flag [.], seq 15 33851660, ack 2321302016, win 115"
id=13 trace_id=72 func=resolve_ip_tuple_fast line=4370 msg="Find an existing ses sion, id-00064870, reply direction"
id=13 trace_id=72 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interf ace-Roaming_0"
id=13 trace_id=72 func=esp_output4 line=885 msg="encrypting, and send to 109.163 .164.237 with source xxx.xxx.xxx.xxx"
id=13 trace_id=72 func=ipsec_output_finish line=231 msg="send to xxx.xxx.xxx.xxx v ia intf-wan2"
2015-02-07 22:39:54.455099 Roaming_0 in 192.168.2.40.22356 -> 192.168.210.2.25: ack 1533851660
2015-02-07 22:39:54.455382 internal4 out 192.168.2.40.22356 -> 192.168.210.2.25: ack 1533851660
2015-02-07 22:39:54.455787 internal4 in 192.168.210.2.25 -> 192.168.2.40.22356: psh 1533851660 ack 2321302016
2015-02-07 22:39:54.455984 Roaming_0 out 192.168.210.2.25 -> 192.168.2.40.22356: psh 1533851660 ack 2321302016
id=13 trace_id=73 func=print_pkt_detail line=4311 msg="vd-root received a packet (proto=6, 192.168.210.2:25->192.168.2.40:22356) from internal4. flag [.], seq 15 33851660, ack 2321302016, win 115"
id=13 trace_id=73 func=resolve_ip_tuple_fast line=4370 msg="Find an existing ses sion, id-00064870, reply direction"
id=13 trace_id=73 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interf ace-Roaming_0"
id=13 trace_id=73 func=esp_output4 line=885 msg="encrypting, and send to xxx.xxx.xxx.xxx with source xxx.xxx.xxx.xxx"
id=13 trace_id=73 func=ipsec_output_finish line=231 msg="send to xxx.xxx.xxx.xxx v ia intf-wan2"
2015-02-07 22:39:54.723772 internal4 in 192.168.210.2.25 -> 192.168.2.40.22356: psh 1533851660 ack 2321302016
2015-02-07 22:39:54.723980 Roaming_0 out 192.168.210.2.25 -> 192.168.2.40.22356: psh 1533851660 ack 2321302016
id=13 trace_id=74 func=print_pkt_detail line=4311 msg="vd-root received a packet (proto=6, 192.168.2.40:22356->192.168.210.2:25) from Roaming_0. flag [.], seq 23 21302016, ack 1533851700, win 260"
id=13 trace_id=74 func=resolve_ip_tuple_fast line=4370 msg="Find an existing ses sion, id-00064870, original direction"
2015-02-07 22:39:54.762732 Roaming_0 in 192.168.2.40.22356 -> 192.168.210.2.25: ack 1533851700
2015-02-07 22:39:54.762969 internal4 out 192.168.2.40.22356 -> 192.168.210.2.25: ack 1533851700
id=13 trace_id=75 func=print_pkt_detail line=4311 msg="vd-root received a packet (proto=6, 192.168.2.40:22356->192.168.210.2:25) from Roaming_0. flag [.], seq 23 21302016, ack 1533851700, win 260"
id=13 trace_id=75 func=resolve_ip_tuple_fast line=4370 msg="Find an existing ses sion, id-00064870, original direction"
2015-02-07 22:39:54.806487 Roaming_0 in 192.168.2.40.22356 -> 192.168.210.2.25: ack 1533851700

Dave_Hall

New Member

Some questions/suggestions @Ismir

- Is the fgt handing more than one public IP address? (e.g. one for the fgt and one for the mail server?)

- try a 3rd party/outside port scanner to see if port 25 is open on the fgt

- confirm fgt's public IP address(es) are not on any spam block lists

- send 2-3 test emails from gmail/hotmail/yahoo, etc. to an company email address to see if what errors pop up.

(You have not posted/indicated what error message outside/3rd parties are getting when they send email to the company, so I suggest the last two points.)

If the fgt is the only device with an outside IP address (e.g. mail server has no public IP), I would set the "External IP Address/Range" on the vip to 0/0 (e.g. wildcard).

On the firewall rule, it's advisable (or best practice) to only open ports when needed, so in this case you should only allow the email service ports through. (e.g. create a service group for those ports).

Dave_Hall

New Member

Haven't completely followed the trace, but it kinda looks like it's getting lost in an ipsec tunnel.

ede_pfau

SuperUser

Now that you have confirmed that port 25 is closed on the public address it's obvious that the VIP is not active. The FGT will act as a proxy for the external VIP address if the VIP is used in a policy.

Still no trace from the sniffer output...but don't worrry, we already know that port 25 is closed.

So let's have a look at the policy table (not only the policy in question). Please post the relevant part of the conifg file ("config firewall policy"..."end") and we'll see.

The good advice from Dave is 100% correct...but...at the moment the VIP isn't active and we have to fix that first. BTW, having the real public IP address or the wildcard in the VIP definition would not really help: the wildcard will be active for the FGT's public address as well, not only for the second address meant for the mailserver. So I would leave the VIP as it is (IF the definition is correct).

oberguruAuthor

New Member

Thank you ede-phau.

here is the config firewall part of config:

config firewall policy
    edit 15
        set srcintf "wan2"
        set dstintf "internal4"
        set srcaddr "all"
        set dstaddr "vipsmtp" ------------- > Policy with SMTP VIP - vipsmtp is VIP group containing SMTP VIP
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 14
        set srcintf "wan2"
        set dstintf "internal4"
        set srcaddr "all"
        set dstaddr "msgroupvipSOFTNET" -----------> Policy with all other VIP (SMTPS, HTTPS, etc) msgroupvipSOFTNET is VIP
        set action accept          group containing these VIPs
        set schedule "always"
        set service "ALL"
        set logtraffic all
    next
    edit 13
        set srcintf "internal1"
        set dstintf "wan2"
        set srcaddr "Filter_basic"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set logtraffic all
        set webfilter-profile "basic_filter"
        set application-list "default"
        set profile-protocol-options "default"
        set nat enable
    next
    edit 4
        set srcintf "internal1"
        set dstintf "wan2"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set nat enable
    next
    edit 25
        set srcintf "internal4"
        set dstintf "wan2"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
    next
    edit 3
        set srcintf "internal1"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
    next
    edit 6
        set srcintf "internal1"
        set dstintf "HQ_to_Liv_p1"
        set srcaddr "Pobjeda_internal"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 7
        set srcintf "HQ_to_Liv_p1"
        set dstintf "internal1"
        set srcaddr "all"
        set dstaddr "Pobjeda_internal"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 9
        set srcintf "Roaming"
        set dstintf "internal1"
        set srcaddr "Wizard_address"
        set dstaddr "Pobjeda_internal"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 10
        set srcintf "internal1"
        set dstintf "Roaming"
        set srcaddr "Pobjeda_internal"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 11
        set srcintf "Roaming"
        set dstintf "wan2"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
    next
    edit 12
        set srcintf "Roaming"
        set dstintf "HQ_to_Liv_p1"
        set srcaddr "Wizard_address"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 24
        set srcintf "internal1"
        set dstintf "internal4"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 19
        set srcintf "internal4"
        set dstintf "internal1"
        set srcaddr "Mail Alternativa"
        set dstaddr "DMZ to SAN STORAGE"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 20
        set srcintf "Roaming"
        set dstintf "internal4"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
end

Here is the VIP section of config file:

config firewall vip
    edit "Mail-server-vip-SMTPS"
        set extip 1.1.1.1 ----------- > Address chanhed for security reason
        set extintf "wan2"
        set portforward enable
        set mappedip 192.168.210.2
        set extport 465
        set mappedport 465
    next
    edit "Mail-server-vip-POP3S"
        set extip 1.1.1.1 
        set extintf "wan2"
        set portforward enable
        set mappedip 192.168.210.2
        set extport 995
        set mappedport 995
    next
    edit "Mail-server-vip-IMAPS"
        set extip 1.1.1.1 
        set extintf "wan2"
        set portforward enable
        set mappedip 192.168.210.2
        set extport 993
        set mappedport 993
    next
    edit "Mail-server-vip-NNTPS"
        set extip 1.1.1.1 
        set extintf "wan2"
        set portforward enable
        set mappedip 192.168.210.2
        set extport 563
        set mappedport 563
    next
    edit "Mail-server-vip-LDAPS"
        set extip 1.1.1.1 
        set extintf "wan2"
        set portforward enable
        set mappedip 192.168.210.2
        set extport 636
        set mappedport 636
    next
    edit "Mail-server-vip-HTTPS"
        set extip 1.1.1.1 
        set extintf "wan2"
        set portforward enable
        set mappedip 192.168.210.2
        set extport 443
        set mappedport 443
    next
    edit "Mail-server-vip-HTTP"
        set extip 1.1.1.1 
        set extintf "wan2"
        set portforward enable
        set mappedip 192.168.210.2
        set extport 80
        set mappedport 80
    next
    edit "Mail-server-VIP-SMTPSUB"
        set extip 1.1.1.1 
        set extintf "wan2"
        set portforward enable
        set mappedip 192.168.210.2
        set extport 587
        set mappedport 587
    next
    edit "MSVIPSMTP"
        set extip 1.1.1.1 
        set extintf "wan2"
        set portforward enable
        set mappedip 192.168.210.2
        set extport 25
        set mappedport 25
    next

emnoc

New Member

Good advice from Ede

Also don't forget the route table, that above output and ipsec-interface seems weird & a little bit suspicion.

oberguruAuthor

New Member

Little update

Since we have available more public address I add additional public address on WAN2 interface as suggested in one post that I found. Create VIP for SMTP and HTTPS for testing purpose from this address to mail server, create policy with new VIP and still have same problem. HTTPS forwarding works like a charm but SMTP port on new address is blocked.

I really don't know what else to do except to restore factory settings and start configuring from scratch. I don't understand how everything works on 4.0 mr3 and after upgrade on 5.0 access to port 25 block.

oberguruAuthor

New Member

1: all other port-forwards are working?

Yes, all other port forwarding work without problem

2: port 25 is not ?

Port 25 is blocked in any scenario

3: have you ensured the policy that allows external into the VIP is order correctly in the sequence? It won't hurt to move it to the top of the chain per-se

Yes, I made that ajustment i GUI (policy - Global view - and ensure that policy for wan2-->internal4 is on the top of the list

emnoc

New Member

Just to be clear;

1: all other port-forwards are working?

2: port 25 is not ?

3: have you ensured the policy that allows external into the VIP is order correctly in the sequence?

It won't hurt to move it to the top of the chain per-se

e.g ( cli )

config firewall policy

move <id#> before < id#>

end

This would be the policy you have is moved before the top most policy-id. i don't think you have to rebuild from scratch, but it does sound like something is not correct or is a stray.

Show more replies

Sign up

Login with SSO

Login to the community

Login with SSO