This article applies to:
- MailMarshal (SEG)
- LevelBlue Secure Email Encryption/MailMarshal SendSecure
Question:
How do I use MailMarshal with my firewall?
Procedure:
When using MailMarshal SMTP with any firewall, ensure that the MailMarshal server IP address is authorized to receive and send SMTP traffic. If the firewall is remapping mail addresses, ensure that the incoming mail addresses are directing mail to the IP address of the MailMarshal server.
Where the firewall has no SMTP server and is a pass-thru or SMTP proxy, then the MX record on the DNS server for the site must be changed to the externally visible IP address of the MailMarshal server.
Where the firewall has its own SMTP server, MailMarshal can be configured to forward all outgoing mail to the firewall.
Note:
Some proxying firewalls limit SMTP functionality using "protocol fixup" or similar settings. These settings can cause problems for a SMTP server such as MailMarshal, because they intentionally modify the SMTP data.
- Specific SMTP commands could be rejected by the firewall
- Some firewalls completely disable ESMTP functionality (the EHLO command), which would cause authentication and TLS among other functions to fail.
LevelBlue recommends that you disable any SMTP "fixup" functionality on your firewall.
See also the following LevelBlue Knowledgebase articles:
- Q11286: Incoming email to a domain is blocked by firewall
- Q10068: Duplicate e-mail messages are received when MailMarshal SMTP is running behind a Cisco PIX firewall.
- Q10905: What ports need to be open in my firewall for MailMarshal SMTP?
- This article was previously published as:
- NETIQKB29089
- Marshal KB66
