How do I use SEG or MailMarshal with my firewall?

This article applies to:

• Trustwave MailMarshal (SEG)/SEG
• Trustwave Secure Email Encryption/MailMarshal SendSecure

Question:

Procedure:

When using MailMarshal SMTP with any firewall, ensure that the MailMarshal server IP address is authorized to receive and send SMTP traffic. If the firewall is remapping mail addresses, ensure that the incoming mail addresses are directing mail to the IP address of the MailMarshal server.

Where the firewall has no SMTP server and is a pass-thru or SMTP proxy, then the MX record on the DNS server for the site must be changed to the externally visible IP address of the MailMarshal server.

Where the firewall has its own SMTP server, MailMarshal can be configured to forward all outgoing mail to the firewall.

Note:

Some proxying firewalls limit SMTP functionality using "protocol fixup" or similar settings. These settings can cause problems for a SMTP server such as MailMarshal, because they intentionally modify the SMTP data.

• Specific SMTP commands could be rejected by the firewall
• Some firewalls completely disable ESMTP functionality (the EHLO command), which would cause authentication and TLS among other functions to fail.

Trustwave recommends that you disable any SMTP "fixup" functionality on your firewall. 

See also the following Trustwave Knowledgebase articles:

• Q11286: Incoming email to a domain is blocked by firewall
• Q10068: Duplicate e-mail messages are received when MailMarshal SMTP is running behind a Cisco PIX firewall.
• Q10905: What ports need to be open in my firewall for MailMarshal SMTP?

This article was previously published as:

NETIQKB29089

Marshal KB66