IronPort accessing LDAP server in suspicious behaviour

[mizwan.saib-c]

Hi Cisco Support Community,

We found that connection between IronPort and LDAP server through port 3268 suddenly spike up. This anomaly still happened until now.

System status shown that there no spike out of E-mail sending and received activity that may caused above issue happened.

Kindly advice us how should to troubleshoot this issue

Thanks

[Ken Stieers]

That connection gets used when it needs to lookup email addresses for inbound mail to see if they're valid address. 

If the LDAP query on the inbound listener is set to happen in the SMTP conversation, and NOT the Work Queue, you won't see the message counters go up, as it kills the connection before the message is completely received.

[mizwan.saib-c]

Hi Ken Stieers,

Thank you on your response. Any suggestion to verify this is legitimate activity?

One more question, let say in a E-mail. There is CC list containing 10 receipients, do IronPort will refer LDAP server for each on the following receipient? And if yes, do this each validating processs considered one connection to LDAP?