User cannot receive email (Reason: 4.4.0 - Other network problem...)

[leoshiu01]

Hi All,

Now there are some of our customers cannot receive our e-mail, when I check dig the log in C170 ESA, it show me following message :

Message 41340762 to user@xxx.com delayed. Reason: 4.4.0 - Other network problem ('000', ['[Errno 54] Connection reset by peer']) []

Anyone encounter the same problem and I would appreciate anyone can help.

Thank you very much

[Libin Varghese]

Hi,

This error would normally point to a network issue with the Ironport not being able to communicate with the destination server.

The network error "Connection reset by peer" means there was an open TCP connection and the receiving server sent a TCP Reset, terminating the connection abruptly. This can happen when a device is rebooted.  However, it is more commonly caused when a security device -- such as a firewall or SMTP proxy --  that is monitoring the connection detects a risk and closes the connection.

When the connection is reset this way, it does not return a 5XX SMTP bounce code.  Therefore, the sending mail server re-queues the message and tries to re-delivery later. If further delivery attempts fail in the same way, the message will bounce because it is in the queue too long ; typically 3 days.

You would need to set up a packet capture for the destination server to confirm the same. This can be done from the GUI -> Help and Support -> Packet Capture.

Regards,

Libin Varghese

[leoshiu01]

Hi Libin,

Thanks for your help for this.

I have done a packet capture but still cannot figure out what problem it is.

Do you have any idea for that problem ?

Thanks

[Libin Varghese]

Hi,

You would need to review the packet capture to determine why the connection was closed abruptly.

You could also set up domain debug logs from WebUI System Administration -> Log Subscriptions for the affected domains.

http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117848-configure-esa-00.html

- Libin