topic Re: SMTP Packet Drop in Firewall and Security Management

SMTP Packet Drop

ChoiYunSoo — Fri, 18 Aug 2023 08:53:14 GMT

Has anyone ever experienced SMTP sessions dropping?

After upgrading the customer's management server OS (R80.10 to R80.40) recently, we are experiencing SMTP packets being dropped.

What is unusual is that there were no policy or other option modifications, and the gateway remains at the original R80.10 version.

As a detailed symptom, the customer's firewall consists of only two interfaces.
And when I run tcpdump on the firewall, I see Syn packets on the inside interface, but I don't see packets going out on the outside interface.

I'm expecting the firewall to randomly drop packets.

Another peculiarity was that the service was normalized when the policy was installed without any modification on the management server.

So I'm thinking it's more likely a firewall and mail server or L4 managed session issue rather than policy or firewall logic.

Are there any settings that can affect firewall sessions in the R80.10 and R80.40 management servers? For example, such as the Inspection Setting part or Virtual Session timeout

I want to execute the 'fw ctl zdebug + drop' command, but I am afraid that secondary problems will occur due to performance load, so I am not able to proceed.

Firewalls usually flow about 6 to 10 Gbps of traffic.

Thanks regards

Re: SMTP Packet Drop

the_rock — Fri, 18 Aug 2023 12:43:15 GMT

You can safely run zdebug command, it definitely would not cause any load on the firewall. By the way, I also suspect something either with inspection settings or possibly IPS.

Re: SMTP Packet Drop

PhoneBoy — Fri, 18 Aug 2023 13:45:56 GMT

Keep in mind R80.10 is End of Support and R80.40 is about to be End of Support.
R81.20 is the current recommended release.

Re: SMTP Packet Drop

ChoiYunSoo — Fri, 08 Sep 2023 09:20:40 GMT

When migrating from R80.10 to 80.40, there are changes in the implied_rule.def and communicated.def files.

However, I am not sure if this was changed intentionally by someone or if the logic changed as the version changed.