Andrew, Whitelisting a particular email address happens at a totally different layer of the system, since email addresses aren't sent until after the SMTP connection is up. You'll want to set up an Incoming Mail Policy for that. ++Don ... View more

We're seeing the same problem. Our outbound mail goes through a private listener with SBRS turned off. We scan for outbound spam to detect cracked accounts, and route spam positive messages to a quarantine. We've seen lots of false positives today. My first thought was that an update to the CASE rules did it. ++Don ... View more

It means the incoming connection terminated before the SMTP client sent the QUIT command. It could mean that the client is badly behaved (the standard requires that clients always issue a QUIT command before closing the connection), or that the connection was forcibly closed by some other means (like maybe a firewall policy kicking in, or the SMTP client process being killed), or that something caused the connection to time out (connectivity problem, crashed client, etc.) If this happens after the DATA phase successfully completes, then the message was successfully handed off before the error and the error is harmless. Otherwise, the message was not complete and the client will need to try it again later. ++Don ... View more

"No message injected within timeout period" means the SMTP client is connecting but not sending a message. Try turning on injection debugging to get an SMTP trace of the connection. ++Don ... View more

Time to talk to TAC, I think. ++Don ... View more

If you have a copy of the message then I'd say TAC is a good place to start. The problem is with McAfee rather than Cisco, but TAC should be able to point you in the right direction. In my observation, CEOs and VIPs should be the last people to have the rules loosened. They are the ones who are in the position to cause the most damage if their accounts or computers are compromised. I asked about the a/v rules because when we turned on McAfee on Friday to deal with the Sophos business, I had to manually update the rules the first time. I didn't know if you had just switched to McAfee or had been using it for a while. ++Don ... View more

Use the "avupdate" command to force a manual update. That should clear it up. I had to do the same thing on our fleet when we switched to McAfee. ++Don ... View more

Use the command "avstatus mcafee" to see if your a/v rules are up to date. ++Don ... View more

Have you tried using a message filter? Redirect-internal-mail: if (recv-listener == "OutboundMail" AND mail-from == "@this-domain\\.com$") {     alt-mailhost("alt.dest.server"); } That's off the cuff, I haven't made any attempt to test it. I'm guessing at the receiving listener name of course. You do need to check for it, since you only want to do this for outbound mail. ++Don ... View more

They can listen on the same port, but they must have different IP addresses. Two different devices cannot share a single IP address, but two different devices on their own separate IP addresses can both listen on the same port. Clustering only gets you configuration synchronization between devices. It does not do any sort of traffic management or load balancing. You need an external load balancer if you want that, or just multiple A and MX records in the DNS if your situation isn't sophisticated enough to warrant load balancer hardware. ++Don ... View more

Ken Stieers wrote: > I'm betting that there's a guid or key or something that the clustering uses... Indeed there is, it's the appliance's serial number. You can see it in the config file, where machine-specific settings are in sections identified by each unit's serial number. Ken's remedy is spot on: remove the old unit from the cluster, give the new one just enough of a config for it to use the network, and join it to the cluster. It will inherit all its other settings from the cluster. If there are any machine-specific settings beyond the normal stuff like host names and IP addresses, then you'll need to add then back manually. I've done this many times, both for replacing failed hardware (fortunately a rare occurrence), and for bringing new units online. Fortunately, all our settings beyond the must-be-local parts are defined at the cluster level. It's worth pointing out that removing one node from a two-node cluster does not cause the cluster to cease to exist. It's perfectly reasonable for a cluster to have only one member. ++Don ... View more

I have yet to find a way to restart individual services myself. Your choices, as far as I know, are to call tech support and have them do it, or reboot. ++Don ... View more