This article applies to:

• Trustwave MailMarshal (SEG) 8.X and below
  • Note that MailMarshal (SEG) 10.X replaces the Console and Configurator with a web-based interface

Symptoms:

• Error occurs when attempting to connect to a MailMarshal (ArrayManager) server in a secure network (DMZ).
• Error: 'Failed to fetch RPC Transport error 0x5 Access is denied'.
• Error: 'You cannot connect to servername because you have insufficient privileges.'

Causes:

There are a number of reasons why the MailMarshal Console or Configurator may be unable to connect to a MailMarshal server (Array Manager) running in the DMZ:

• The TCP port that the MailMarshal Console and Configurator use to connect to the MailMarshal server may not be accessible through the firewall.  
• For the Configurator, the required Windows RPC ports (TCP 137,138,139) may not be accessible.
• The logged on user account for the MailMarshal Configurator may not be able to authenticate with the MailMarshal server.
• Windows Firewall may be denying remote access.

Information:

To address this issue:

• The MailMarshal Console and Configurator connect to the MailMarshal server on TCP port 19001 by default. Make sure the DMZ firewall and Windows Firewall are configured to allow communication on this port. For more information about Windows Firewall settings, see Q12209.
   
• The MailMarshal server will seek a user authentication; because it is running in the DMZ, the MailMarshal server may not be able to authenticate a user from the internal network.
  • For MailMarshal SMTP 6.X, 7.X, and 8.X, best practice is to install the Array Manager in the internal network. In this case, access and authentication should be possible. If the Array Manager is in the DMZ, you can still connect using the Console because you can enter any Windows credential when connecting. Enter a credential that has administrative privilege on the MailMarshal server. To use the Configurator in this case, you could connect to the server by RDP.
  • For MailMarshal SMTP 5.X, you could connect to the server by RDP. You could also allow Windows authentication traffic between the DMZ and the internal network; however this is a less secure solution.

This article was previously published as:

NETIQKB39835