hi all, I'm trying to figure out the pipeline when ESA is getting bounce for none-existing user. The thing is that: - client from my domain (user1@domain.com) wants to send the email to user in different doman (lets call him imaginary@dest.com) - outgoing content filters are applied for this communication as the following table: 1 Add/Edit Header insert-header("Return-Receipt-To", "<user2@domain.com>") 2 Add/Edit Header edit-header-text("Return-Path", "user1@domain.com", "<user2@domain.com>") 3 Add/Edit Header insert-header("Disposition-Notification-To", " < user2@domain.com > ") 4 Add/Edit Header edit-header-text("From", "TEST1  < user1@domain.com > ", "TEST2  < user2@domain.com > ") 5 Add/Edit Header insert-header("Envelope-FROM", " < user2@domain.com > ") 6 Send Copy (Bcc:) bcc (" < user2@domain.com > ", "$Subject") which in general says that replace the mail-from for this outgoing mail. user2@domain.com is receiving the copy which is correct (rule 6) - and lall headers are replaced accordingly I want the bounce message hit user2@domain.com not the original user1@domain.com is ESA keeping some kind of cache that this bouce should hit the original message? Would message filters help in that case? are content filters applied before ESA establishes SMTP connections to the destination server or are they being applied in a fly?  when establishing telnet on 25 port RCPT verification is done before typing rest of the message so I started to wonder which is first for outgoing connection. It would be stupid to do it in a fly especially when one TCP connection is being used for multiple mail delivery but I cant explain the following behavior. 25 Apr 2017 14:42:13 (GMT +02:00) SMTP delivery connection (DCID 34204) opened from Cisco IronPort interface 10.x.x.71 to IP address 10.x.y.175 on port 25. 25 Apr 2017 14:43:47 (GMT +02:00) Protocol SMTP interface private (IP 10.x.x.71) on incoming connection (ICID 311146) from sender IP 10.x.y.74. Reverse DNS host srv1.domain.com verified yes. 25 Apr 2017 14:43:47 (GMT +02:00) (ICID 311146) RELAY sender group RELAYLIST match 10.x.y.74 SBRS not enabled 25 Apr 2017 14:43:47 (GMT +02:00) Start message 11779 on incoming connection (ICID 311146). 25 Apr 2017 14:43:47 (GMT +02:00) Message 11779 enqueued on incoming connection (ICID 311146) from user1@domain.com. 25 Apr 2017 14:43:47 (GMT +02:00) Message 11779 on incoming connection (ICID 311146) added recipient (imaginary@DEST.com). 25 Apr 2017 14:43:47 (GMT +02:00) Message 11779 contains message ID header '<368D0E11E885214EBDEBEB274888537B683C@MAIL1.domain.com>'. 25 Apr 2017 14:43:47 (GMT +02:00) Message 11779 original subject on injection: SUBJECT-XXX numer 12/25 25 Apr 2017 14:43:47 (GMT +02:00) Message 11779 (1697 bytes) from user1@domain.com ready. 25 Apr 2017 14:43:47 (GMT +02:00) Message 11779 matched per-recipient policy RULE1 for outbound mail policies. 25 Apr 2017 14:43:47 (GMT +02:00) Start message 11780 on incoming connection (ICID 0). 25 Apr 2017 14:43:47 (GMT +02:00) A new message 11780 was generated based on message 11779 by bcc filter CONTENET-FILTER-RULE1. 25 Apr 2017 14:43:47 (GMT +02:00) Message 11780 enqueued on incoming connection (ICID 0) from MAILER-DAEMON@domena.com. 25 Apr 2017 14:43:47 (GMT +02:00) Message 11780 on incoming connection (ICID 0) added recipient (user2@domain.com). 25 Apr 2017 14:43:47 (GMT +02:00) Message 11780 is not signed. No domain key profile matches user2@domain.com. 25 Apr 2017 14:43:47 (GMT +02:00) Message 11780 not signed. No DKIM profile matched user2@domain.com. 25 Apr 2017 14:43:47 (GMT +02:00) Message 11780 (1699 bytes) from MAILER-DAEMON@domena.com ready. 25 Apr 2017 14:43:47 (GMT +02:00) Message 11780 queued for delivery. 25 Apr 2017 14:43:47 (GMT +02:00) Message 11779 queued for delivery. 25 Apr 2017 14:43:47 (GMT +02:00) (DCID 34204) Delivery started for message 11780 to user2@domain.com. 25 Apr 2017 14:43:47 (GMT +02:00) SMTP delivery connection (DCID 34205) opened from Cisco IronPort interface 10.x.z.71 to IP address 217.x.x.x on port 25. 25 Apr 2017 14:43:47 (GMT +02:00) (DCID 34205) Delivery started for message 11779 to imaginary@DEST.com. 25 Apr 2017 14:43:47 (GMT +02:00) (DCID 34205) Message 11779 to imaginary@DEST.com bounced by destination serve r. Reason: 5.1.0 - Unknown address error ('550', ['5.1.1 Account not found ']) 25 Apr 2017 14:43:47 (GMT +02:00) Start message 11781 on incoming connection (ICID 0). 25 Apr 2017 14:43:47 (GMT +02:00) A new message 11781 was generated to handle bounce of message 11779. 25 Apr 2017 14:43:47 (GMT +02:00) Message 11781 enqueued on incoming connection (ICID 0) from . 25 Apr 2017 14:43:47 (GMT +02:00) Message 11781 on incoming connection (ICID 0) added recipient (user1@domain.com) . 25 Apr 2017 14:43:47 (GMT +02:00) Message 11781 (3032 bytes) from ready. 25 Apr 2017 14:43:47 (GMT +02:00) Message 11781 queued for delivery. 25 Apr 2017 14:43:47 (GMT +02:00) SMTP delivery connection (DCID 34206) opened from Cisco IronPort interface 10.x.x.71 to IP address 10.x.y.74 on port 25. 25 Apr 2017 14:43:47 (GMT +02:00) (DCID 34206) Delivery started for message 11781 to user1@domain.com. 25 Apr 2017 14:43:48 (GMT +02:00) (DCID 34206) Delivery details: Message 11781 sent to user1@domain.com 25 Apr 2017 14:43:48 (GMT +02:00) Message 11781 to user1@domain.com received remote SMTP response '2.6.0 <133526$bg5@srv1.domain.com> [InternalId=4943507357704, Hostname=srv1.domain.com] Queued mail for delivery'. 25 Apr 2017 14:44:12 (GMT +02:00) (DCID 34204) Delivery details: Message 11780 sent to user2@domain.com 25 Apr 2017 14:44:12 (GMT +02:00) Message 11780 to user2@domain.com received remote SMTP response '2.6.0 <368D0E11E885214EBDEBEB274888537B683C@MAIL1.domain.com> [InternalId=2800318676999, Hostname=exchange.domain.com] Queued mail for delivery'. If someone could explain it to me I would be very grateful regards Przemek ... View more

hi, I'm looking for some information how to troubleshoot SMTP functionality on ISE. I mean - whether there is an information that ISE sent a mail to exchange or sth. We've got email notification on guest/sponsor. I want to check whether sponsor didn't click "notify" or ISE couldn't send a email. Which logs should I look into? regards Przemek ... View more

hi all,   could anyone tell me what CoA error code 506 mean? 506 Resources Unavailable From time to time Im seeing it on ISE (1.4)   I see it as an error but what was the cause of it? The session on the switch ended before it receifed CoA request? or what?   regards Przemek   ... View more

Hi all,   I'm a little bit concerned/intrigued regarding the command "clear authentication sess" Im using it a lot when testing 802.1x on ISE deployment and haven't noticed before one important thing. It doesn't triger EAPoL-START from the swtich when MAB was used as a fallback! Is it right? can someone confirm it? when endpoint is authenticated using 8021.x then "clear auth" triggers EAPoL-START as supposed to. when endpoint is authenticated by MAB - then nothing.   when for some reasons supplicant is not working right on the end client, and we are working on fixing it but it is seen as MAB (for example with CWA) then the only way to make it work is SHUT/NO SHUT the port   In my opinion after clearing the session the switch should send this frame nevertheless without any implacation whether it is going to authenticate by MAB or 802.1x   What do u think?   regards   ... View more