For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Nuruddin_Ahmed_'s avatar
Nuruddin_Ahmed_
Icon for Cirrostratus rankCirrostratus
Jan 30, 2017

X-Forward for SMTP

Hi guys,   Reading through various posts here on devcentral I have a feeling I will not be able to achieve what I want but I rather ask again.   Our topology looks like: source -> firewall -> F...
application delivery
BIG-IP
LTM
IheartF5_45022's avatar
IheartF5_45022
Icon for Nacreous rankNacreous
Jan 30, 2017

So there's no X-Forwarded-For - type trick to be used here sorry :-)

 

Why don't you assign a specific SNAT address, to be used ONLY for your authorised SMTP virtual server (so you'd use a SNAT pool instead of automap, with one pool member), and then give the mail guys the SNAT address to configure on the Mail server?

 

  • Nuruddin_Ahmed_'s avatar
    Nuruddin_Ahmed_
    Icon for Cirrostratus rankCirrostratus
    Jan 31, 2017

    Hi, how they would blacklist any specific mail gateway in this case?

     

  • IheartF5_45022's avatar
    IheartF5_45022
    Icon for Nacreous rankNacreous
    Jan 31, 2017

    Whoops - I hadn't read your question carefully enough. You have a few options;

     

    • reconfigure your topology so that SNAT is not required
    • configure the blacklist on the F5 (sample iRule code below)

    I'm guessing that you want to avoid a topology reconfiguration so let's try with the blacklist

     

    How is the blacklist configured on the SMTP server? Is it a simple IP blacklist, or do they perform a reverse lookup of the IP against an DNS server?