Connection problem with Symantc DLP

[Steflstefan]

We changed from Forcepoint to Cisco ESA.

The scenario for outgoing messages:
Internal ESA -> Symantec DLP -> External ESA

Symantec act like a proxy. If you start a telnet to Symantec IP Port 25, you will receive the smtp greeting from external ESA and you are speaking "directly" with external ESA through the Symantec.

After 40 messages, the internal ESA receive "451 4.4.2 Error: Connection lost to forwarding agent."when it tries to send a message. Monitor / Delivery Status shows Destination Domain and Latest Host Status = Down for long time.

When you than connect with telnet how described before, you 'll receive "451 4.4.2 Error: Connection lost to forwarding agent." again and again till you send a quit.

If the scenario is:
Internal ESA -> External ESA MailFlow goes up and I can send many messages in short time.

Formerly with the Forcepoint Appliances we don't have this problem.

Have anyone an idea what's happened? What means the "forwarding agent"?

Thanks in advance for any hints.
Greets, Stefan

[Libin Varghese]

Based on the details provided it would appear the Symactec DLP system is throttling connections from the ESA.

I would recommend checking on the Symanted DLP to see if there is hard limit configured for the number of messages within an hour, number of messages over a single connection etc. set to 40.

This does not appear to be configuration on the ESA itself since ESA to ESA traffic is working without the same errors.

I did find a couple of articles online which may be useful to you:

https://support.symantec.com/en_US/article.HOWTO15644.html

https://support.symantec.com/en_US/article.TECH93068.html

Regards,

Libin Varghese

[Steflstefan · Accepted solution]

Hello Libin,

one of your links has routed me to a good intention for this strange behavior.
The reason was TLS. Because SymantecDLP act like a "proxy server" between the ESA -> ESA connection the TLS wouldn't handled properly.
Our solution now:
on internal ESA set up a destination control to DLP IP with TLS off
on DLP disable TLS by remove STARTTLS from RequestProcessor.AllowExtensions in the Advanced Server Settings of each Network Prevent for Email server settings

on external ESA set up a HAT for DLP hosts with a mailflow policy and set TLS off in the mailflow policy

It seems that failed TLS connections to the "target" ESA (external ESA) will not be closed properly, if TLS connection fails. This results in mass open inbound connections.

Actually, we try to use TLS on all connection but in this case we have no chance to use it.
However, it works now.

Regards Stefan

[Libin Varghese]

Stefan,

Thank you for sharing the solution.

Regards,

Libin Varghese