use cluster member as External Spam Quarantine

[Dan Reid]

We're in the process of converting over our physical 'Ironport' appliances to the new virtual ESA builds. 

On the old Ironports we have two units - they are not clustered and from what I can tell they enabled the spam quarantine on the secondary and on the primary they set the IP of the secondary as the external spam quarantine address, port 25. This seems to work fine, users only get 1 spam notification for anything either Ironport quarantines. 

On the new virtual ESAs we've deployed, we've attempted to duplicate this config and it really doesn't seem to work. We get the following message when the one ESA tries to send quarantined messages to the second ESA - 

ISQ: Could not connect to off-box quarantine at xxx.xxx.xxx.xxx:25

The goal is to consolidate the spam quarantine between these two units so users only receive 1 spam notification, which is how the old units were configured. Seems like maybe in the new code this isn't supported without an SMA?

[Libin Varghese]

Well its not a supported configuration to consolidate the spam quarantine without SMA.

However, based on the error it does appear to be network connectivity issue.

You can try to telnet from one appliance to the other to confirm the same.

- Libin V

[Dan Reid]

We've verified connectivity - we can telnet between the units on the ip/port we've tried to use as the external quarantine and they talk fine.

I think the older units we have pre-date SMA being a product, so that may be why it worked on those. 

[Libin Varghese · Accepted solution]

I tried it on a couple of boxes running Async OS 9.7 and worked as expected.

esa0.esa-lab.co.local> grep "MID 1364" mail_logs

Wed Jul 5 04:53:46 2017 Info: Start MID 1364 ICID 215
Wed Jul 5 04:53:46 2017 Info: MID 1364 ICID 215 From: <libivarg@gmail.com>
Wed Jul 5 04:53:57 2017 Info: MID 1364 ICID 215 RID 0 To: <libivarg@esa-lab.in.local>
Wed Jul 5 04:53:57 2017 Info: MID 1364 SPF: helo identity postmaster@LIBIVARG-WIN7 None
Wed Jul 5 04:54:37 2017 Info: MID 1364 SPF: mailfrom identity libivarg@gmail.com TempError
Wed Jul 5 04:55:17 2017 Info: MID 1364 SPF: pra identity libivarg@gmail.com TempError headers from
Wed Jul 5 04:55:17 2017 Info: MID 1364 Subject 'Test'
Wed Jul 5 04:55:17 2017 Info: MID 1364 ready 130 bytes from <libivarg@gmail.com>
Wed Jul 5 04:55:18 2017 Info: MID 1364 matched all recipients for per-recipient policy DEFAULT in the inbound table
Wed Jul 5 04:55:19 2017 Info: MID 1364 interim AV verdict using Sophos CLEAN
Wed Jul 5 04:55:19 2017 Info: MID 1364 antivirus negative
Wed Jul 5 04:55:19 2017 Info: MID 1364 AMP file reputation verdict : CLEAN
Wed Jul 5 04:55:19 2017 Info: MID 1364 Outbreak Filters: verdict negative
Wed Jul 5 04:55:19 2017 Info: ISQ: Tagging MID 1364 for quarantine (X-Ironport-Quarantine)
Wed Jul 5 04:55:19 2017 Info: MID 1364 queued for delivery
Wed Jul 5 04:56:20 2017 Info: Delivery start DCID 12677 MID 1364 to RID [0] to offbox IronPort Spam Quarantine
Wed Jul 5 04:56:40 2017 Info: Message done DCID 12677 MID 1364 to RID [0] (external quarantine)
Wed Jul 5 04:56:40 2017 Info: MID 1364 RID [0] Response 'ok: Message 246 accepted'
Wed Jul 5 04:56:40 2017 Info: Message finished MID 1364 done

esa0.esa-lab.co.local> grep "DCID 12677" mail_logs

Wed Jul 5 04:55:19 2017 Info: New SMTP DCID 12677 interface 10.122.187.140 address 10.122.187.141 port 25
Wed Jul 5 04:56:20 2017 Info: Delivery start DCID 12677 MID 1364 to RID [0] to offbox IronPort Spam Quarantine
Wed Jul 5 04:56:40 2017 Info: Message done DCID 12677 MID 1364 to RID [0] (external quarantine)
Wed Jul 5 04:56:45 2017 Info: DCID 12677 close

Went from .140 to .141 over port 25.

- Libin V

[Dan Reid]

Interesting - thanks for testing, we've cleared all the associated configs off these ESA's and will try it again.

I have our network team re-verifying all the network configs as well

[Libin Varghese]

Sure. No problem.

It should work as per me once communication between the appliances is successful.

Glad to help.

- Libin V

[Dan Reid]

after some digging we found inspect esmtp was still enabled on the ASA and was causing smtp banner mistmatches.

once that was disabled everything started working immediately. our primary ESA is now using our secondary ESA for its external spam quarantine

thanks for you assistance!

[Libin Varghese]

Awesome news.

Thank you for sharing what was done to get it fixed.

- Libin V

[Ken Stieers]

Hey Dan,

Which interface on the "spam quarantine" box did you point the other box at??... or does it matter?

Ken