Forum Discussion
SMTP inline load balancing with no SMTP greeting
We currently have two cisco IronPort Email Security Appliances that are load balances using the BIG IP. These appliances are placed behind the BIG IP (the BIG IP is their default gateway). When configuring the virtual server with no snat, when the client is initially connected, he is not presented with an SMTP greeting. Once snat is configured as automap, the SMTP greeting would appear to the client. We want to pass the client IP address to the IronPort appliances so we do not want to configure SNAT.
We are facing some issues with web servers that send emails using java. When they try to communicate with the Virtual IP load balancing the IronPort appliances, while no snat is configured, an error would appear and the message delivery would fail. Once the snat is configured as automap, the mail delivery would be successful. We want to perform some access control on the IronPort based on IP addresses, so we want to pass the actual server IP address.
As a workaround, we have created an irule that turns on snat automap if it matches a list of IP addresses (of web servers). Otherwise, snat is disabled for other clients.
Is there a way we can pass the SMTP greeting to the client without configuring snat automap?
4 Replies
- Vernon_97235Historic F5 Account
How do you have the Virtual Server configured? If it's a Standard TCP (with no higher layer profiles) or fastL4, then any response made by the server should be proxied through the BIG-IP. Have you had a chance to tcpdump to verify that the server is sending the greeting (I assume you mean the 220 initial message?) in both cases (i.e., with and without SNAT)?
- Huwaihi_195804
Nimbostratus
The virtual server is configured with standard TCP. I do not understand the point regarding tcpdump (I know what tcpdump is, but I am not sure how to utilize it here). Yes, I am referring to the 220 initial message. This message is only appearing when snat is configured as automap.
- VernonWells
Employee
How do you have the Virtual Server configured? If it's a Standard TCP (with no higher layer profiles) or fastL4, then any response made by the server should be proxied through the BIG-IP. Have you had a chance to tcpdump to verify that the server is sending the greeting (I assume you mean the 220 initial message?) in both cases (i.e., with and without SNAT)?
- Huwaihi_195804
Nimbostratus
The virtual server is configured with standard TCP. I do not understand the point regarding tcpdump (I know what tcpdump is, but I am not sure how to utilize it here). Yes, I am referring to the 220 initial message. This message is only appearing when snat is configured as automap.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com