Access IMAP/SMTP behind ISA?


Recommended Posts

I'm trying to acces IMAP and SMTP behind ISA. Every mail client i try just fails to connect and i've tried several domains including googlemail.

I have creating the following access rule:

Mail Access Protocol - Enabled / Allow

Selected Protocols - HTTP, HTTPS, SMTP, IMAP4, IMAPS, POP3

From - INTERNAL

To - EXTERNAL

Users - ALL USERS

Schedule - ALWAYS

All content types

Do i need to do anything else besides setup the access rule?

One thing i have noticed is that the SMTP filter port range is 465, but gmail says to set this as 587. In ISA the option to add more ports is grayed out?

Anyone have any experience with this?

Link to comment
https://www.neowin.net/forum/topic/881980-access-imapsmtp-behind-isa/
Share on other sites

I can't access it using PuTTy and when i check logs i can see 'Connection Denied' from my IP address when using basic authentication but when i change the ports to what google says i get nothing.

Make sure the imap.gmail.com:993 OR (74.125.155.109:993) for IMAP and smtp.gmail.com:465 Or (74.125.127.109:465) is allow in your Firewall, then check telnet

1)TELNET imap.gmail.com 993

2)TELNET smtp.gmail.com 465

if you using googleAps and configured your domain with google for Mailing then use 587 port for SMTP (TLS Enabled)

3)TELNET smtp.gmail.com 587

telnet imap.gmail.com 993

Connecting To imap.gmail.com...Could not open connection to the host, on port 993: Connect failed

telnet imap.gmail.com 456

Connecting To imap.gmail.com...Could not open connection to the host, on port 456: Connect failed

telnet imap.gmail.com 587

Connecting To imap.gmail.com...Could not open connection to the host, on port 587: Connect failed

I can't see the option to allow it in ISA, the imap protocols are there and in use in the access rule above but it also wont let me add anymore ports.

telnet imap.gmail.com 993

Connecting To imap.gmail.com...Could not open connection to the host, on port 993: Connect failed

telnet imap.gmail.com 456

Connecting To imap.gmail.com...Could not open connection to the host, on port 456: Connect failed

telnet imap.gmail.com 587

Connecting To imap.gmail.com...Could not open connection to the host, on port 587: Connect failed

I can't see the option to allow it in ISA, the imap protocols are there and in use in the access rule above but it also wont let me add anymore ports.

how much you experience in ISA Server out of ?/10

Try to Create new role in ISA and specify Source address/IP and Destination/IP, port number and allows access...

how much you experience in ISA Server out of ?/10

Try to Create new role in ISA and specify Source address/IP and Destination/IP, port number and allows access...

I'm not at professional level.

Can you point me in the right direction to create a new roll in ISA?

#

I tried creating a new protocol for GMAIL SSL ports and adding that to the mail access rule but got nothing.

I'm not at professional level.

Can you point me in the right direction to create a new roll in ISA?

#

I tried creating a new protocol for GMAIL SSL ports and adding that to the mail access rule but got nothing.

can you upload the screen shots of ISA Allowed/denied source and destination, and tell me one thing you specified imap.gmail.com/smtp.gmail.com any where in ISA server. ?

can you upload the screen shots of ISA Allowed/denied source and destination, and tell me one thing you specified imap.gmail.com/smtp.gmail.com any where in ISA server. ?

NO i haven't specified imap.gmail.com/smtp.gmail.com - i don't know where to do it?

as i say my experience is little.

post-54971-12682294590879_thumb.jpg

Thank you for taking the time to do that, but i still got nothing.

here are the details of the access rule, is everything correct?

New Access Rule:

Gmail (Enabled / Allow)

Protocols:

IMAP4

IMAP4 Server

IMAPS

IMAPS Server

SMTP

SMTP Server

SMTP-GMAIL (TCP / 587 / Outbound) < custom protocol i made with ports for Gmail

From:

Internal

Local Host

To:

smtp.gmail.com (Address Range: 74.125.127.109 to 74.125.155.109)

Users:

All Users

I've updated ISA to latest service pack and it provides more info on the logs.

All i get is:

Unidentified IP Traffic(TCP:1745) Initiated Connection

Unidentified IP Traffic(TCP:1745) Connection Closed

Initiated Connection

Log type: Firewall service

Status: The operation completed successfully.

Rule: Source: Internal ( 192.168.16.73:63894)

Destination: Local Host ( 192.168.16.4:1745)

Protocol: Unidentified IP Traffic (TCP:1745)

User:

Additional information

  • Number of bytes sent:
  • Number of bytes received:
  • Processing time: 0ms
  • Original Client IP: 192.168.16.73
  • Client agent:

then:

Closed Connection

Log type: Firewall service

Status: A connection was gracefully closed in an orderly shutdown process with a three-way FIN-initiated handshake.

Rule: Source: Internal ( 192.168.16.73:63894)

Destination: Local Host ( 192.168.16.4:1745)

Protocol: Unidentified IP Traffic (TCP:1745)

User:

Additional information

  • Number of bytes sent: 16530
  • Number of bytes received: 15514
  • Processing time: 4000ms
  • Original Client IP: 192.168.16.73
  • Client agent:

I'm seriously thinning out on top.

Is there another firewall/router upstream from your ISA server?

umm.. yeah

ISA Firewall --> Router <--File Server

...........................^^^

...................Cachepilot (Internet)

or maybe it's just a switch, i'm not 100% sure on that one i didn't install it.

no...it's in a building with 50+ computers, 3 hubs.

Hi,

Looking at your issue, theres a lot of stuff kinda wonky with your rules. For one if you are already allowing everyone to access HTTP/HTTPs in an Allow everyone internet access rule ... you should not be specifying HTTP and HTTPs again in your SMTP/IMAP rules.

Now lets get started.

What you want to do is define a new Access rule. In this access rule you want to name it something like 'Allow SMTP client Access' so it's easily identifiable.

Also in your diagram you say it goes .... ISA Firewall --> Router --> File Server ?

Where is the internet connection connected into?

Is the internet connection at the Router or at the ISA firewall?

Also if the internet connection is at the router I think you diagram should probably go something like Router --> ISA Firewall --> File Server .... with the ISA firewall protecting the File server or am I misunderstanding your layout.

Next you want to specify the Action as Allow

In the protocol tab you want to Add SMTP and SMTPS (These normally can be found in the Mail protocol section.) - You did this

Since you mentioned IMAP you also want to add IMAP4 and IMAPS (These are also found in the Mail protocol section.) - You did this

Next you will want to define a New custom protocol. This protocol should allow TCP on port 587. (This is frequently used port for remote SMTP access since port 25 is blocked by most major ISPs.). Name this custom protocol something like 'SMTP (587)' - You DID NOT do this

You want to add this new SMTP (587) protocol to your allowed protocol set. (The protocol you created will be found under the User-Defined section) - You DID NOT do this

On the From tab you want to allow either Internal or All Protected Networks or whatever group you want to have access that you have previously defined.

On the To tab you want to specify External

Users tab should be 'all users' or the designated users you want to have access.

Apply the rule.

Apply the rule to ISA

Now on the ISA server go to the monitoring section.

Setup a monitor with a rule to monitor traffic from the Client you want to test from.

Now go to that client and attempt the connection.

You should be able to successfully connect out now and you should be able to see every connection attempt and the pathing as it happens in the ISA monitor.

If nothing else is blocking or in front the ISA connection to the outside world you should be able to connect or at least be able to see what path it's taking and when is it dropping.

If you're seeing no connection attempts on the designated ports then you may have something else causing the problem or something is denied/blocked in another rule that is processing before it gets to your matched rule.

Let me know if this gets you on the right track.

HI, thanks for your detailed walk through, i think i did add the new port anyway but i went through it non the less incase i missed anything.

now when i try to send and receive in Outlook 2007

i get this

[email protected] - Sending - Complete

Syncronising subscribed folders for [email protected] - Errors

Task 'Synchronizing subscribed folders for [email protected].' reported error (0x800CCC0E) : 'Outlook cannot synchronize subscribed folders for [email protected]. Error: Cannot connect to the server. If you continue to receive this message, contact your server administrator or Internet service provider (ISP).'

Attached is a screen shot of the ISA log output:

38375812.jpg

The Firewall, Server and Cachepilot(internet access) all go into a switch/router in the cabinet.

HI, thanks for your detailed walk through, i think i did add the new port anyway but i went through it non the less incase i missed anything.

now when i try to send and receive in Outlook 2007

i get this

[email protected] - Sending - Complete

Syncronising subscribed folders for [email protected] - Errors

Attached is a screen shot of the ISA log output:

38375812.jpg

The Firewall, Server and Cachepilot(internet access) all go into a switch/router in the cabinet.

In your screen shots what is the 192.168.16.4 IP address? Is that an upstream firewall/router that web traffic gets passed through?

You might try refining your monitor filter to actually only show traffic going to Port 587 and 445 and 25 for the clients IP address to see if you see any activity. If you don't .... then you have something else going on before the traffic reaches the ISA firewall.

You should be seeing an attempt to connect to the specified port to the specified destination (Actual google imap address) but since you are seeing a connection going to port 1745 at that internal IP address either you have some rule that is redirecting traffic or your setup is configured to direct traffic up to that 192.168.16.4 address on port 1745 and then whatever that box is .... does something else with the traffic.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • State of Decay 3 is out in 2027, reveals Plague Nests with new co-op gameplay trailer by Pulasthi Ariyasinghe A few months ago, Undead Labs broke its silence about the third entry in the State of Decay series since its announcement in 2020. Today, the studio had a brand-new trailer to reveal at the Xbox Games Showcase, finally giving players a look at the Unreal Engine 5-powered title. A broad 2027 release window is now attached to State of Decay 3 too. The studio confirmed that every scene seen in the gameplay trailer (except for the studio logo) released today is from the game with no cinematic footage. "The quality bar of the moment-to-moment experience is higher than anything we’ve achieved in Undead Labs’ history," says the studio. "State of Decay 3 is being built in Unreal Engine 5, and we’re creating better quality versions of what makes our game the survival sandbox it is, and the combat experience is really, really important to us, and I think you can see it coming through in this trailer." One new aspect of this upcoming entry is the Plague Nests. These are supposed to be dynamic, dungeon‑like enemy hubs with varied “personas” that change tactics each time one appears on a map. These areas will have the best loot in the game for players brave enough to tackle them. The combat system is being overhauled too, letting players do quick and power attacks depending on the situation. This isn't just on the player's side though, as zombies themselves now have multiple new types of behaviors depending on how fresh or decayed they are. "All of these play very differently, especially as you start getting outnumbered or when you’re making noise and running around and trying to save your rear end or the rear end of your friend next to you," adds the developer. Of course, settlement building and community management are massive parts of this third entry too. These are being further expanded with the cooperative focus, giving players much more freedom for playing together than in State of Decay 2. Players will even be able to split up and build settlements in different areas of the same map with different goals. Undead Labs confirmed that playtests are already ongoing for the title, and interested players can sign up to participate by heading over here once more slots open up ahead of the full release. State of Decay 3 is coming out on PC, Xbox Series X|S, PlayStation 5, and Xbox Game Pass sometime in 2027.
    • Doom: The Dark Ages Revelations expansion gives the Slayer a brutal Chain Spear by Pulasthi Ariyasinghe Last year, id Software released Doom: The Dark Ages as a prequel to its reboot series, offering a look at the legendary Slayer character during an ancient war between Hell and Heaven. Today, at the Xbox Games Showcase, id Software returned with a new announcement that unveiled Doom: The Dark Ages Revelations as its first story expansion. The expansion will see the Slayer being betrayed and cast into a "merciless purgatory only escapable by confronting haunting truths." Somehow, there is one ally in all this chaos seemingly attempting to help our protagonist escape his fate. Players will be ascending this prison and fighting plenty of new demons and abominations as they work to free the Slayer's followers. One new aspect of the expansion will be the Chain Spear. This new weapon is described by the studio as a "uniquely satisfying combat system that rewards mastery with a potent combination of power and mobility." Check out the trailer below to see the new weapon in action, where the Slayer is seen using it to even pin enemies to walls. id Software is also preparing a free update to all owners of Doom: The Dark Ages that will land alongside the new paid expansion. Dubbed the Ripatorium 3.0 update, this will add more customization options, an improved pass code generation system, and preset options for players diving into the game's arena challenge mode. Expansion buyers will also receive additional maps, demons, and new weapons to use in this mode in addition to the story levels. Doom: The Dark Ages Revelations expansion is out on July 7 across PC, Xbox Series X|S, and PlayStation 5 with a $19.99 price tag. Those who own the Premium Edition or the Collector's Bundle will receive the expansion for no extra cost as well.
    • Hyped for this. Replayed the remasters recently and they're so well done, and Crash 4 was great too. I trust this team to deliver.
    • Ninja Theory's new Hellblade game is action-focused and set in Purgatory by Pulasthi Ariyasinghe Ninja Thery has been building its award-winning Hellblade series since 2017, delivering Senua's Sacrifice and Senua's Saga since then. Today at the 2026 Xbox Games Showcase, the studio had a brand-new installment announcement featuring Senua again, but this time, she is in a version of purgatory, and the focus is on the action. Simply named Senua, this new entry is described as a "full-on action-adventure" experience, delivering an expanded focus on combat, puzzle-solving, and freedom of exploration. The developer says that it is keeping the same high production values and storytelling features of the previous games while giving what players have been asking for in the gameplay department. The entirety of Ninja Theory is now working on Senua, giving the project much more manpower than ever before, while also letting the team draw on its action roots from Devil May Cry and prior titles. However, the studio also confirmed that its previously announced Project Mara horror experience is no longer in development. Alongside snappier traversal moves, Senua will be able to take stealth and direct combat routes. She has access to her own sword, plus any enemy weapons as well, with dual wielding also being an option for most dropped melee swords, axes, and other weapons. Outside of melee combat, Senua will be able to use special abilities that let her alter the reality around her. The world is said to be about twice the size of Hellblade 2. While this won't be an open-world experience, the linear story will let players explore their surroundings further than before. The story of Senua will be set after the events of previous Hellblade titles, with our protagonist being stuck in her own version of Purgatory. The series' well-explored psychosis themes will return as well. "She’s trapped between life and death on a quest to reach the afterlife and be reunited with the ones that she’s loved and lost," adds the studio. "Her belief is that by healing the wounds of her life, she can find the peace that is the key that unlocks the gate to the afterlife." Senua is releasing on Xbox Series X|S, PC, and PlayStation 5 sometime in 2027.
  • Recent Achievements

    • Proficient
      Eric Biran went up a rank
      Proficient
    • Dedicated
      Conjor earned a badge
      Dedicated
    • Week One Done
      Windows Guy earned a badge
      Week One Done
    • Dedicated
      Mark Spruce earned a badge
      Dedicated
    • Collaborator
      conkir earned a badge
      Collaborator
  • Popular Contributors

    1. 1
      +primortal
      492
    2. 2
      PsYcHoKiLLa
      248
    3. 3
      Steven P.
      72
    4. 4
      +Edouard
      68
    5. 5
      ATLien_0
      67
  • Tell a friend

    Love Neowin? Tell a friend!