DynamicID integration with Internal SMTP Relay

[chuka01]

I am configuring DynamicID for remote users using an IP-whitelist internal SMTP relay. I have set up the connection string on the gateway, and whitelisted the gateway's IP addresses on the SMTP server.

The smtp/25 traffic shows up in logs as accepted, but it does not reach the SMTP server and gives the error: dynamicid sending failed, press r to retry".

This is a sample of the smtp connection string i use: mail:TO=$EMAIL;SMTPSERVER=172.16.11.233;FROM=sslvp
n@example.com;BODY=$RAWMESSAGE

telnet 172.16.11.233 25 also connects successfully

Thanks for your help.

[chuka01]

Please can anyone help with this.

[simonemantovani]

Hello

some questions:

• question do you have a Check Point gateway or a Check Poing cluster?
• Which IP did you whitelisted? The physical IP of the firewall or the VIP IP address?

[chuka01]

Hello Simone,

• It is a cluster, but only one gateway is currently up and running
• We whitelisted both the Physical IP of the gateway (10.45.10.3) and VIP IP (10.45.10.1). 

The traffic shows up on the internal Palo firewall on the Virtual IP (10.45.10.1) as you recommended before, and set an allow rule for that, yet it still does not arrive at the SMTP server. Thank you.

[simonemantovani]

Ok but if there is another firewall behind your checkpoint and the smpt, maybe the issue is on that firewall or in case outside of the check point.

Try investigate on the Palo Alto to see if the request is accepted and where it's routed.

[chuka01]

I was thinking it was still a checkpoint firewall issue, cause of the error of "DynamicID sending failure, press r to retry" error, but i will trace the route from Palo Alto, and report my findings. Thank you very much