Problems with filter exception using Network IP range

Question

We are using a spam filtering service for out incoming email. As such, all
our email is directed to our SMTP server from their IP address range. We
employ a dual firewal set up. We have a Netscreen firewall connected to the
Internet and the Border Manager 3.8 server sits between the Netscreen and
our internal network. On the BM server I have set up a generic proxy with a
proxy port of 1025 to proxy the incoming email to our internal mail server.
The Netscreen is set up to forward all SMTP (port 25) traffic to the
BorderManager server on port 1025. Using FiltCfg I also set up a packet
filter exception to allow traffice from the service providers network
(Network = 104.56.144.0, Mask = 255.255.248.0) to port 1025. With this
setup most email is received just fine. However I was getting reports of
bounced and delayed email. Working with our service provider it was
detemined that randomly some connections were failing. I used PktScan to
collect packet trace infomation from our BM server. On a regular basis
there are groups of SYN packets from the service providers email servers
which are not receiving a response from the BM server. In some cases the BM
server does eventuall respond with a SYN/ACK. There are also times when the
BM server responds immediately after the first SYN. All the incoming
connections from the service provider are currently comming in from two IP
addresses, 104.56.144.247 and 104.56.145.247. The BM server is showing the
same problem for both IP addresses, sometimes it responds immediatley to the
SYN, sometimes it takes a few SYN packets before it responds, and sometimes
the BM server never responds to the connection attempt. On a whim I added
filter exceptions which specifed the two host IP addresses specifically
(other than that the rules are identical to the one using the Network
specification). After doing this the BM server is now responing immediately
to all the incoming SMTP connection attempts from the service provider. Why
would I be seeing this problem with the filter exception defined with a
Network specification but not with Host specifications? Is there anything I
can do to fix this?
Thank you for any help provided,
Brad Johnson

Answer 1

Yes. I created 8 separate 255.255.255.0 exceptions. In viewing the packet
trace data for the last couple of days it appears this resoloved the
problem.
Thanks
Brad Johnson
"Craig Johnson" <[email protected]> wrote in message
news:[email protected]..
> In article <XCo8l.13813$[email protected]>, Brad Johnson
> wrote:
>> Both servers are running NW 6.5 sp 6. After this problem started I
>> applied
>> BM38sp5_IR1, TCP681K, and wsock6o. This had no affect on the issue.
>>
>> If I create individual exceptions for the IP addresses I am currently
>> receiving mail from, rather than using the range of potential addresses,
>> the
>> problem goes away.
>>
> Well, it sounds definitive enough, but I think if it were a generic issue
> to
> the patch level I would have heard about it from my clients who use
> Postini
> mail filtering service. All of the Postini-related servers have a network
> address as a source in the filter exceptions for smtp.
>
> Instead of using a 255.255.248.0 mask, does it work if you set up 8
> different
> 255.255.255.0 exceptions?
>
>
> Craig Johnson
> Novell Support Connection SysOp
> *** For a current patch list, tips, handy files and books on
> BorderManager, go to http://www.craigjconsulting.com ***
>
>