ironport aborts receiving without explanation

[Alibek Ismailov]

Hello, Ironport aborts receiving many messages with empty subject from one existing sender. Maybe it is notification-messages (or bounce messages) about receiving from sender mail server, because ironport receives some messages from that mail server with subject or maybe it is sender's mail server rejects notification-messages from my server (see attachment). There is no explanation in logs why ironport aborts this messages.

What is the problem? number of simultaneous connections? or what?

[martin.eppler]

Hello Alibek,

there could be several explanations for this, for instance that a protocol aware firewall is killing here the connection with a RST or FIN packet. I'd recommend to set up an injection debug log and a packet capture for a known sender IP address you expect mails from to drill this down further.

Best regards,

Martin

[Alibek Ismailov]

I made debug log, but there is no explanation.

If firewall killed connection, he would kill all connections, but ironport receives some messages from that sender.

I ll check packet capture, maybe it'd help.

Thanks

[Libin Varghese]

Alibek,

A firewall or any other network equipment with SMTP inspections features can result in emails receiving/delivery issues intermittently.

This would not be reflected in all emails as certain packets may trigger the inspection feature while others may not.

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113423-asa-esmtp-smtp-inspection.html

http://www.cisco.com/c/en/us/about/security-center/intelligence/asa-esmtp-starttls.html

Thanks

Libin

[Alibek Ismailov]

Ok, thanks, i will check it too