Ironport C170 - Outbound encrypted emails hang in PXE encryption queue

We had a power outage on site, and since the power has been restored, our encrypted emails have not been sending out.  Message tracking on the C170 states ----Message XXXXXX has been enqueued for PXE encryption.------
We eventually get a bounce with the following info.
-------Diagnostic code = NoDiagnostic; Reason code = TransferFailed; Status code = 500
< #5.0.0 smtp; 5.x.3 - Temporary PXE Encryption failure. Please try resending the message. If the problem persists, please contact your administrator. (Encryption operation expired due to key server communication problems or resource constraints.) (delivery attempts: 14)>--------
I've verified communication from the C170 to https://res.cisco.com  and I've rebooted the C170, but the problem remains. 
Where to go from here?
Thanks!
Aaron

There are 18 in the queue, and it's showing that there have been 126 hard bounces.    I have a support case opened this morning (SR 632888329), but I've not heard back since the initial email where they asked me to establish a tunnel.  I responded with the requested information.  I'm going to reach out again as people are getting antsy.
I've included the info from the hard bounces.
02 Dec 2014 09:10:56 (GMT -05:00) Message 732069 has been enqueued for PXE encryption.
02 Dec 2014 11:13:07 (GMT -05:00) Message 732069 pending PXE encryption until Tue Dec 2 11:28:07 2014 as per encryption profile APS.
02 Dec 2014 11:41:09 (GMT -05:00) Message 732069 pending PXE encryption until Tue Dec 2 11:56:10 2014 as per encryption profile APS.
02 Dec 2014 12:09:12 (GMT -05:00) Message 732069 pending PXE encryption until Tue Dec 2 12:24:12 2014 as per encryption profile APS.
02 Dec 2014 12:35:13 (GMT -05:00) Message 732069 pending PXE encryption until Tue Dec 2 12:50:14 2014 as per encryption profile APS.
02 Dec 2014 13:01:16 (GMT -05:00) Message 732069 pending PXE encryption until Tue Dec 2 13:10:57 2014 as per encryption profile APS.
02 Dec 2014 13:21:17 (GMT -05:00) Message 732069 exceeded maximum queue life time in the encryption queue.
02 Dec 2014 13:21:17 (GMT -05:00) (DCID 0) Message 732069 to [email protected] bounced by destination server. Reason: 5.x.3 - Temporary PXE Encryption failure. Please try resending the message. If the problem persists, please contact your administrator. (Encryption operation expired due to key server communication problems or resource constraints.) ('000', [])

Similar Messages

  • Ironport C170 Relay outgoing Email to External Server

    We have a new Ironport C170 and am only using the appliance for Encryption/DLP.  We wish to have incoming and outgoing Email to flow through this appliance.  All incoming Email will be relayed to our Exchange Server and all outgoing Email will be relayed to our SAAS Email Filtering System for processing and delivery.  The incoming part I believe is configured correctly but am having issues figuring out how to relay all outgoing to a specific domain in the cloud.
    Any assistance would be greatly welcomed,
    Stephen

    Hi Stephen,
    You can control all the outgoing mail from SMTP Route configuration, if is in GUI menu > Netowork > SMTP Route.
    You can define the route to next hop based on destination domain, as for default - all other domains (this is the one that goes to SaaS) you can enter your cloud SMTP address and the port number there.
    Hope this helps.
    Thanks,
    Donny

  • Proper TLS Config for IronPort C170

    I inherited an infrastructure a little bit ago that uses an IronPort C170 cluster for email security. I have been tasked with configuring TLS connections with our new medical benefits provider and have some issues doing so. We have 3 MX records, let's call them mail1, mail2 and mail3. Mail1 and mail2 are configured normally on our firewall to pass SMTP traffic on port 25 to the MailListener port on the IronPort which is 25. Mail3, however, is configured on the firewall to translate SMTP traffic on port 25 to port 3600 which is sent to the TLS Listener port 3600 on the IronPort. The IronPort MailInterfaces are configured as such (25,3600) Reverse configuration on the firewall takes any port 3600 traffic from the IronPort and translates it to port 25 traffic for the rest of the world.
    I configured the IronPort with a new Sender Group named TLS_ACCEPT,  added all the medical provider domain names/IPs to it and assigned it to  the ACCEPTED Mail Flow Policy where TLS is set to Required. Likewise,  for outgoing, I specified the same domain names/IPs within the  Destination Controls to require TLS for sending purposes.
    I replaced the guy who originally configured this so I am not too sure how it is setup on the other end for TLS connections already established. We do have a few in place that are active. I am assuming that the other end is configured to send email only to the mail3 MX record. This configuration, however, is not possible with our medical provider so I need an alternative. They have verified that they cannot contact us on mail1 or mail2 via TLS but can with mail3.
    The obvious problem is if a sender from these new domains tries to send TLS_required emails to us over the mail1 and mail2 MX IPs, they will receive an NDR. If I configure the firewall to translate mail1 and mail2 incoming connections from port 25 to 3600, any email sent with TLS not prefered/required will get an NDR. This was actually tested and domains like Yahoo and Hotmail could not send to us.
    Are there any options for me on the IronPort to allow these connections to be sent from all our MX IPs without having to translate the ports? If not, what would happen if I changed the TLS Listener port on the IronPort to 25 instead of 3600 and disabled all the NAT rules on the firewall for mail3? I am only to assume this translation was another security step added by the previous admin here but am not too sure what would happen if I eliminated it.
    Any advice, help, questions, assistance or fun-poking would be greatly appreciated!! Thank you in advance!

    Kevin,
    OMG there's so much unneeded complication here...You can totally ditch the port translation
    Here's what I did:
    Under Network/IP interfaces, I have 3 interfaces:  managment, Public, Private.
         Public is exposed to the net, only port 25 allowed in/out, with 1 A  record for a Domain1 which I have a certificate for.
    Under Network/Listener I have 2 Listeners: 
         Outbound on the Private interface not really relavent for the rest of this discussion
         Inbound on the Public interface
              listening on port 25
              using an Accept query pointed at my Active Directory (all the various email domains in 1 AD)
              using a cert that matches the hostname on the Public interface
              Mail flow polices in HAT all set to TLS preferred with an address list configed for the "required" ones
    Mail Policies/Destination Controls to force sending as TLS
    In my external DNS
         Domain1
              A  mail.domain1.com  x.x.x.
              mx domain1.com  mail.domain1.com pref 10 weight 10 TTL 86400
         Domain2-10
              mx domain2.com mail.domain1.com
              mx domain3.com mail.domain1.com
         etc....
    Hope that helps...
    Ken    

  • My Ironport C170 delay to send the email to some domain

    I found the problem at my IronPort C170, It always cannot sent email to some domain and show message detail code 4.4.0 or 4.4.2, then put in the queue. But I try to set to use as relay to another SMTP server, it can send mail very smoothly. Do you have any ideas that I misconfigure?
    Thank you

    Hi Billy, if you move mouse cursor over the number of spam messages on page Monitor>Spam quarantine, what URL address you see?
    Something like https://www.domain.com:83/Search?auth=13900f1d2a029b017464c596a88bb7a8?
    Can you resove "www.domain.com" to correct IP address of your ESA server?
    Are Spam Quarantine>Spam Quarantine HTTP & Spam Quarantine HTTPS enabled at Network>IP Interfaces>Interface page? Do interface's IP address & spam quarantine ports match to URL address (does www.domain.com resolve to this IP address) at Monitor>Spam quarantine?
    Is there any firewall blocking this connection?

  • Forwarding all mail from one ironport C170 to another (C160)

    Good Morning,
    Could someone tell me how to forward all mail which hits my ironport c170 at one site to another c160 at the other please?  I have tried adding SMTP routes but this doesnt seem to work.
    many thanks,
    Dave                  

    Hi,
    Yes we have done this.
    Message tracking log as follows...
    09 Apr 2013 14:58:41 (GMT +01:00)
    Protocol SMTP interface Data 2 (IP x.x.x.x) on incoming connection (ICID 59) from sender IP x.x.x.x. Reverse DNS host None verified no.
    09 Apr 2013 14:58:41 (GMT +01:00)
    (ICID 59) RELAY sender group Incoming Relay match [sendmail_server_ip] SBRS not enabled
    09 Apr 2013 14:58:41 (GMT +01:00)
    Start message 1114 on incoming connection (ICID 59).
    09 Apr 2013 14:58:41 (GMT +01:00)
    Message 1114 enqueued on incoming connection (ICID 59) from [email protected]
    09 Apr 2013 14:58:41 (GMT +01:00)
    Message 1114 on incoming connection (ICID 59) added recipient ([email protected]).
    09 Apr 2013 14:58:41 (GMT +01:00)
    Message 1114 incoming relay (sendmail_server): Header Received found, IP address 127.0.0.1 being used, SBRS not enabled
    09 Apr 2013 14:58:41 (GMT +01:00)
    Message 1114 contains message ID header '<'">201304091358.r39Dwe8Z004098@sendmail_server>'.
    09 Apr 2013 14:58:41 (GMT +01:00)
    Message 1114 (658 bytes) from [email protected] ready.
    09 Apr 2013 14:58:41 (GMT +01:00)
    Message 1114 matched per-recipient policy DEFAULT for outbound mail policies.
    09 Apr 2013 14:58:41 (GMT +01:00)
    Message 1114 scanned by Anti-Virus engine Sophos. Interim verdict: CLEAN
    09 Apr 2013 14:58:41 (GMT +01:00)
    Message 1114 scanned by Anti-Virus engine. Final verdict: Negative
    09 Apr 2013 14:58:41 (GMT +01:00)
    Message 1114 queued for delivery.

  • Cisco Email IronPort is not sneding email to outside [Errno 61] Connection refused

    Dears,
    I have deployed new ESA C170. for incoming emails it works normally. But when we send email to most of domains like yahoo, hotmail, gmail...etc, the email get stuck and tracking shows ( queued for delivery). Mail logs show the following error:
    Sat Nov 22 16:18:43 2014 Info: Connection Error: DCID 20515 domain: hotmail.com IP: 65.55.92.152 port: 25 details: [Errno 61] Connection refused interface: 172.20.1.20 reason: network error
    And when I navigate to "monitor" -> " Delivery Status" it shows all the mentioned domains "Down".
    After long monitoring, I discovered that emails going to mail servers inside Saudi Arabia are not affected they are delivered successfully.
    But when comes to global mail servers like hotmail it fails. using Macafee threat intelligence tool, it shows the global IP of ironport as "High risk".
    Notice that the IP is not blacklisted anywhere else.
    Is this service provider related issue? And how can I make sure that it is problem in the IP...
    Thanks,,,

    Thx for ur response..
    actually I have single-homed box with one connected interface.
    I can ping gmail server but i cannot telnet it on port 25..after deep investigation i discovered that Macafee classifies the IP as "high-risk" although it is not black-listed in all reputation servers.
    the issue is not resolved yet.
    i don't know how can I unblock it in Macafee

  • How to install renewed feature key to cluster Ironport C170

                       Our email gateway use two Ironport C170 cluster, recently the feature key expired on both C170 and we are in the process of getting this feature key renewed.
    I am new to this cisco ironport, I would like to know once we get this renewed feature key how can we install it on both Ironport C170. the feature currently expired is: "Centralized Management, IronPort Anti-Spam, Sophos Anti-Virus, Outbreak Filters".
    After the feature key expired several changes has been made to ironport incoming content filters, because the "centralized management" feature expired these changes are made to both C170 ironport, does this have any impact on installing the renewed feature key?
    Thanks.

    Hi Rugang,
    You can manually install the keys via Web UI or CLI.
    In the Web UI, please log in as admin and go to :
    System Administration -> Feature Keys -> Section named: Feature Activation
    Paste the key string you received in the field named: Feature Key: then hit the button Submit key. You may need to accept the User Agreement. After that the system will validate the key and if everything goes well, you will have the feature ready to use.
    In the CLI, please log in ad asmin and run:
    > featurekey
    then run:
    activate
    then paste the string for the key you want to install
    There is no need to commit changes. You can finish the featurekey command by pressing the ENTER key in your keyboard.
    It would be advisable to do not make changes witht he boxes not running Centralized Management due to key expiration, but it seems you already did that. The devices will try to synchronize the settings and it is possible that you will find inconsistencies. You can use the command:
    > clustercheck
    to view/fix the inconsistencies. This command/action can only be executed via CLI.
    I would recommend that you save the configuration from both devices; apply the keys and save the configuration again. Run a diff (linux/unix) or windiff on the files (before and after installing the keys) to see if you find anything which requires your intervention.
    As always, please contact our customer support in case you have any questions or have any issues with the whole process.
    I hope this helps.
    Regards,
    -Valter

  • Cisco Ironport C170

    Hi ,
    I already configure the ironport C170 for incoming , outgoing , Content Filtering and Antispam.
    But Antispam is not working properly. If I send out the email , messsage hearder never show the ironport antispam.
    I can see the Ironport Antivirus header only. How can we test the anti spam is working before we added the incoming
    production domain to ironport? Please see in the pictures. Currently OS running with 8.0.1.Please help me check thanks,
    Thanks,
    infoakh

    Please see the following:
    http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117865-qanda-esa-00.html
    -Robert

  • IronPort C170 Redundancy

    Hi All,
    I currently have 2 IronPort C170 appliances. I wanted to ask is it possible to configure them to be in hot-standby configuration? If not, what are my alternatives to provide redundancy?

    Usually, when it comes to email, redundancy is achieved by exposing multiple boxes to the internet on port 25, setting up A records for each one, and setting up mulitple MX records, with disimilar weights if you want to direct most of the traffic to one of them.  The clustering facility afforded you in the Ironrport boxes allows you to manage them from one console, but it has no redundancy/failover implications.
    You could use a network load balancer, and it can detect if one of the boxes is no longer accepting mail and then move the traffic to the other box.
    Hope that helps...
    Ken

  • Backup and restore quarantines cisco ironport c170

    Hello,
    Is there anyway to backup and restore the spams quarantine to another ironport c170?
    Thanks in advance.
    Alexandre

    You have the wrong forum... Try posting it on this forum:
    https://supportforums.cisco.com/community/netpro/security/ironport

  • Backup and restore logs, quarantines cisco ironport c170

    Hello,
    Is there anyway to backup and restore logs and quarantine to another ironport c170?
    Thanks in advance.
    Alexandre

    Hello Alexandre,
    logs can easily be downloaded via FTP or SCP, there is a folder per logs subscription, i.e.
    /mail_logs
    /system_logs
    /error_logs
    Each folder contains multiple logs, thos e are with extention .s are the ones that have rolled over, while .c and .current are the ones currently written to. I would not recommend to upload them to another appliance, as this may cause problems or at least confusion. Quarantines cannot be backed up, that functionality is limited to SMAs (M-series).
    Hope that helps,
    Andreas

  • I have a cisco ironport c170, i want set up URL redirect? But i don't khow how to ? Can you help me?

    I have a cisco ironport c170, i want set up URL redirect? But i don't khow how to ? Can you help me?

    The C170 does not support URL redirection prior to OS release 8.5. What exactly do you need to accomplish?

  • Ironport C170 Config file restore

    Hi Team,
    We have 2 clustered Ironport server with AsyncOS 7.5.2  with site 1 and now we are building new DR site for Exchange 2010 and buiding Ironport on DR site.
    We have one ironport AsyncOS 7.6.2 for Cisco IronPort C170 build 201 at DR site.
    We have to restore configuration file from Site 1 to DR site.
    Can you please provide me the steps to restore the file from site 1 to DR site
    I have removed the one node from ironport cluster from site 1 and taken the backup of the configuration file.
    Regards,
    Pravin

    Pravin -
    You will need to upgrade all appliances to the same revision in order to have the configuration used from site 1 to the DR.  Also, 7.5.2 and 7.6.2 are EOL, and you would be strongly suggested to upgrade to the minimum of 7.6.3-019 for all appliances.
    After that - it would just be a matter of looking at this two ways - while upgrading the appliances at site 1, just save the configuration copy once upgraded as needed to 7.6.3-019.  Make a copy and modify the Network Configuration section: Hostname, Interface <IP>, Routing Table... and then load that copy on the DR site.
    Or - the other way to look at it would be to just join the DR site to the cluster.  That way all configuration is shared among the three appliances.
    I hope this helps!
    -Robert
    (*If you have received the answer to your original question, and found this helpful/correct - please mark the question as answered, and be sure to leave a rating to reflect!)

  • Ironport C170 Central Management Feature...

    We have a SINGLE Ironport C170 that was set up by an IT Services group here over 6 years ago- before I was hired. We have been getting the following message e-mailed to us recently:
    The Warning message is:
    Your "Centralized Management" key will expire in under 5 day(s).  Please contact your authorized Cisco sales representative.
    Our concern here is this:
    We do not use "Centralized Management"- we only have one office, one E-mail Security appliance. Should we worry about this feature expiring? Is this a Feature Key that we will need to purchase a renewal for? I appreciate any insight into this issue.
    Q.M. Quiney
    Network Admin
    Precision Payroll of America

    Centralized management key was separate (non-free) feature key for connecting multiple appliances in the cluster. Now this license key is included in all newer SW versions in the base license.
    If you're not using multiple appliances you don't need this feature and you can ignore this warning.
    Just to be sure you're not using a single appliance in a cluster check cluster status with CLI->clusterconfig.

  • Is the cisco ironport c170 end of sale?

    Hi,
    I was wondering whether the Cisco Ironport C170 is end of sale?, if so what is the replacement?
    Thanks

    Hi Juan,
    As far as I know C170 is not in end of sale.
    You can verify with your Cisco Account contacts for more details.

Maybe you are looking for