PIX logging messages

[tmcmillion]

We have what I would consider to be some abnormal behavior on one of my mail servers. The server admins says everything is OK but I disagree. I have a whole bunch (100 or so) per minute of the following series of entries in my PIX log file from this Server. Is this normal behavior?

%PIX-6-302013: Built outbound TCP connection 40391293 for outside:68.216.187.33/25 (68.216.187.33/25) to DMZ:172.23.5.9/3989 (65.196.5.9/3989)

%PIX-6-106015: Deny TCP (no connection) from 68.216.187.33/25 to 65.196.5.9/3989 flags RST on interface outside

%PIX-6-302014: Teardown TCP connection 40391293 for outside:68.216.187.33/25 to DMZ:172.23.5.9/3989 duration 0:00:01 bytes 324 TCP Reset-O

[nkhawaja]

No, this doesnt seem normal. Seems like server at 172.23.5.9 is trying to send emails but the connections gets dropped because PIX is seeing RST packets. Is this MS exchange server? do you have fixup smtp disabled?

what version of PIX

any thing changed?

Thanks

Nadeem

[tmcmillion]

This is POP server used for relaying. fixup smtp is not disabled and there have been know chnages on the PIX. I came across this problem while helping one the server admins troubleshoot a problem with the server.