Spam Blocker not Working!!

[m00re]

Hi there guys.

I need your help with some issue that we have since the very 1st beginning.

We cant filter any email using spam blocker, we have a Cisco 2800 router, Untangle on bridge mode to our network.
All the others products work like protocol control, web filter, soy blocker etc etc.
The only one that seems not to be working is the spam blocker.

We have the green light on rack, SMTP Scan is enabled like all the other options.
But no email seems to be scanned from internet to exchange. The only smtp emails that appears to be scan on event log are the emails that are being sent from outlook using some other SMTP account, no exchange

Any ideas??

Thanks

[dwasserman]

You use the standar smtp port 25?
Its forwarded from your router to the internal exchange server?
The outbound smtp traffic is not scanned by default

smtpmail.jpg

[m00re]

Thanks dwasserman for your quick replay!

YES my email use the standard port (25)

I'd just noticed now that i have a public IP and Exchange have other.
When i go to Whatsmyip.com i have one IP like this *5.**8.**9.201 and when i ping the mx mail.*******.pt i have other IP *5.**8.**9.203.
It could be this?
All the public range is being handle by the same router.
Is there any way to work around this ?

Thanks

[dwasserman]

You manage the router?
Post here the Nat and forward rules
Also the interfaces config in untangle
And the interface config in the exchange server
I suspect some routing or default gateway problem.

[m00re]

Hi there!
The router isn't managed by us at PT
The router is managed by our communication team at CZ.

But i suspect has we have a 2800 series cisco that allows to have multi wans they had configured it on a different way!
The usual way should just be a portfwd to internal IP on port 25.
But we have the untangle filtering web traffic on ip ***.***.***.201 and email traffic goes to ***.***.***.203.
I guess we are using this .203 to our exchange server and untangle don't filter that traffic (i guess)
Is there any way for untangle check more thaan one public ip?

Our config

Cisco 2800 -> Untangle (bridge) -> Network Switch

Exchange use the same gateway than i 10.132.1.254 (cisco 2800)

[dwasserman]

You are behind a router that have some nat work, and all in your lan sound like well (same scope, same default gateway.
I think you must call with your communication team to solve the problem.
Maybe the router have two or more internal ip, or some weird design.
For test pourposes you can put a switch between your untangle and router, connect a pc and telnet to your exchange server port 25.

[proactivens]

Make sure your cables are not backwards. It sounds like you have untangles external plugged into the switch and the internal of untangle plugged into the router.

[m00re]

Make sure your cables are not backwards. It sounds like you have untangles external plugged into the switch and the internal of untangle plugged into the router.

If its the way you say does the Untangle filter WEB, phishing, virus, block protocol?
Because all the others are working unless Spam Filter.

Usually when i configure a router (not a cisco specialist) what i do is, i only have one public IP using nAT i fwd all the traffic on port 25 to exchange IP.
In my case scenario what i think that they have done, is on cisco configured a different public IP for WEB surf and Email.
For web surfing i have *****.201 and for email ****.203 so my question is how can Untangle filter the web traffic and not the email traffic.
Apparently they had FWD mail.company.pt to internal exchange IP (10.132.1.6)

Thanks

[proactivens]

yes, everything will work if its plugged in wrong, some things, like the spam filter, wont work correctly. Just switch the cables around and see what result you get.

[joemailey]

It shouldnt matter if your router has more than 1 public IP.

Mine has about 7 different IPs.

One assigned directly for Exchange/email.

If you have your network setup like this:

Cisco Router > plugged in to Untangle > Untangle connected to your internal network.
Providing you have just one cable coming from your router and plugged in to your untangle box, means all traffic has to pass via Untangle before it gets to the internal network.

Just make sure you have the cables plugged in to the right connections like said above.