Error

[rockbd]

Recently sometime my mail user facing a different error when they send mail they don't get any message after 2 hr they get following message

Remote Server returned '<[X.X.X.X] #5.0.0 smtp; 5.4.7 - Delivery expired (message too old) [Default] '[Errno 54] Connection reset by peer' (delivery attempts: 1)>'

If i go to ironport message details i got the following error

(DCID 554445) Message 4988960 to t.n@nn.zz.com delayed. Reason: 4.4.0 - Other network problem ('000', ['[Errno 54] Connection reset by peer']) []

As it send error message if the message isn't delivered after 2 hour they get lot of problem.

Any suggestion what causes this error.

[Libin Varghese]

The error indicates a netwotk issue, likely a firewall interrupting communication with the destination server.

I would recommend setting up a packet capture to confirm.

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117797-technote-esa-00.html
https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118467-technote-esa-00.html

Regards,
Libin Varghese

[rockbd]

Thanks for the prompt reply.

Firewall means .. is there any firewall in build in IronPort or network firewall which IronPort have to go to connect internet.

The incident don't happen every time but it is happening. So how long should i run the packet capture? Or it just to check connectivity. Please give a suggestion.

Also as it is not that happen continuously so send mail now might go to the receiver domain. I just to know the cause why sometime it fail to reach the destination. 

[Libin Varghese]

If the issue is intermittent running a live capture may not be of much help.

We would need a capture on the ESA while the issue is ongoing.

The ESA does not have inbuilt firewall features, it would send the traffic through the network equipment in your environment to reach the internet. The connection can be interrupted by any one of the network devices including the network firewall.

Regards,

Libin Varghese