Policy Violation on MTA with Thread Emulation/Extraction

[Alex_Lillo]

Hi mates!

This is my very first post so i'll try to do my best.

We are facing a strange issue where immedately after enabling the Thread Emulation and Thread Prevention blades (along with the MTA) on the checkpoint cluster, all mail traffic flow stops.

Our mail flow setup consists of 2 Exchange 2010 Edge Transport servers in our DMZ, and 2 Exchange hub Transport servers in the internal security zone, all of them connected with a Edge Subscription. All security zones are connected via our 15400 two-node ClusterXL, on R80.10.

The behavior is really strange because when we enable the blades and the MTA, all mail queues stop delivering and the Exchange queue viewer show a "POLICY VIOLATION" error.

Please don't hesitate to ask for further information. 

Lot of thanks 

[PhoneBoy]

What log messages do you see on the Check Point?
Have you done packet traces to see what happens at the TCP level?
Do the servers require TLS to communicate?
If that's not been accounted for in the configuration, that might cause delivery issues.

[TP_Master]

In addition, @Alex_Lillo you should look in the MTA audit logs to see which errors the exchange server returns when trying to deliver to it.

[Alex_Lillo]

Sorry for the delay. We have been dealing with this all this time along with TAC. 

This issue has been resolved applying the same fix as per https://www.cpug.org/forums/archive/index.php/t-10927.html

now we are dealing with newer ones (0 bytes on throughput counters...)

Thx for your time!