For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Nuruddin_Ahmed_'s avatar
Nuruddin_Ahmed_
Icon for Cirrostratus rankCirrostratus
Jan 30, 2017

X-Forward for SMTP

Hi guys,   Reading through various posts here on devcentral I have a feeling I will not be able to achieve what I want but I rather ask again.   Our topology looks like: source -> firewall -> F...
application delivery
BIG-IP
LTM
IheartF5_45022's avatar
IheartF5_45022
Icon for Nacreous rankNacreous
Jan 30, 2017

So there's no X-Forwarded-For - type trick to be used here sorry :-)

 

Why don't you assign a specific SNAT address, to be used ONLY for your authorised SMTP virtual server (so you'd use a SNAT pool instead of automap, with one pool member), and then give the mail guys the SNAT address to configure on the Mail server?

 

IheartF5_45022's avatar
IheartF5_45022
Icon for Nacreous rankNacreous
Jan 31, 2017

Whoops - I hadn't read your question carefully enough. You have a few options;

 

  • reconfigure your topology so that SNAT is not required
  • configure the blacklist on the F5 (sample iRule code below)

I'm guessing that you want to avoid a topology reconfiguration so let's try with the blacklist

 

How is the blacklist configured on the SMTP server? Is it a simple IP blacklist, or do they perform a reverse lookup of the IP against an DNS server?