Groupwise Sending and receiving on separate NICs

I am trying to establish if you can split the traffic through the Gwia to go through different network cards - incoming mail on one card and outgoing on another.
The background is:
The firewall is a Netpilot. The MX record also points to the Netpilot, which will continue to receive the mail. We want the outgoing mail to leave through a separate NIC. The purpose, as I understand it, is that, since the Netpilot is the default gateway, any (or most) virus activity inside the network, will attempt to send mail through the default gateway. This client had his domain blocked some time ago because of a virus that got in from somewhere. We can now safely block any outgoing email traffic on the netpilot if Groupwise can send mail on a different nic, ensuring that virusses cannot send mail out of the network. Hence the need to split the incoming and outgoing mail over 2 nics.
Is this possible? I posted this question on the Novell Support Forum yesterday and had no response (yet). That makes me wonder if this can be done.
Ben KeyserOwner/EntrepreneurAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

PsiCopConnect With a Mentor Commented:
Well, you didn't bother to specify the VERSION of GroupWise, what SP2, if any have been applied, and what PLATFORM and VERSION you're running GroupWise on. So I'm going to assume you're using GroupWise v6.5 SP2 on a NetWare v6.5 SP2 platform. If you're not, well, you need to tell us these things - we're Experts, not mindreaders.

Short Answer: No, not easily.

Long Answer: Not easily, but you could possible do it on NetWare v6.5 thru the use of separate instances of GWIA in separate Address Spaces and each bound to a specific NIC, one configured only to send E-Mail and the other to only receive E-Mail. Or running GWIA on a *NIX platform, again with separate instances, each bound to a specific NIC with a specific config.

The issue is that the daemon that listens on Port 25 is really a separate piece of code from the GWIA itself (the GWIA handles trnaslating SMTP to GroupWise's internal format, the reverse; and routing to/from the MTA). Its going to tend to bind to all available IP addresses, and GWIA doesn't know about daemons, it just knows that if it puts an outgoing E-Mail in a certain queue directory, it vanishes and that files keep arriving in another queue directory for it to process.

In theory, you can do this. You create two different GWIAs in the GroupWise system, probably one each in their own Secondary Domain (so you're adding one or two MTAs to the mix here as well). For the Domain(s) where the users are located, you define the "Outbound" GWIA as the default destination for outbound/Internet E-Mail. This will force the MTA(s) to route all Internet E-Mail to that Domain for just that GWIA to process.

The Incoming-only GWIA does present an issue, since it can still generate SMTP-reject messages if it runs into problems, so it may still send out Internet E-mail. Or want to. I'm not sure if such traffic can be routed to the other Domain.
BTW, you may have noted that GroupWise does not have its own TA under the E-Mail heading. If you'd like to help change this, then a nice (free) message in the New Topics request area would be helpful.
gilesjpConnect With a Mentor Commented:
Hi, Good question. Try this it should work.

1) You need three NIC's set two of the NIC's up as teaming so they will have       the same IP Address.
2) Enter this address into the GWIA ( Using Console One browse to GWIA in NDS mode go to properties--> Groupwise Tab --> network address) and set up in DNS.
3) The cables from the teamed NIC's need to be pluged into port A and B of the switch.
4) Set an Access list for inbound traffic on port A
5) Set an Access list for outbound traffic on port B
6) Use the 3rd NIC for the general IP address of the server so other stuff on the server can run unhampered.

The 14th Annual Expert Award Winners

The results are in! Meet the top members of our 2017 Expert Awards. Congratulations to all who qualified!

The trouble with that arrangement is that you have no control over which IP address GroupWise will use for what. So it may very well try to use the inbound-only IP address for outbound traffic and start queueing up a lot of E-Mail because it thinks its running into a 450 Host Down situation.
This will work.  Groupwise is ignorant of the entire set up. The switch will do the work. Groupwise doesn't decide anything. There is no inbound only address
because the inbound and outbound NIC's have the same address they are TEAMED. The switch will route the traffic to the proper NIC thought the access list on the ports. Groupwise just thinks there is only one NIC.
Ah, I see what you're getting at. You still need to prevent the GWIA from binding to the "general use" NIC.

And it is also dependent on having NICs capable of Teaming (altho most are, since its mainly done in software) and on a switching infrastructure that can control access with that granularity. If you have that hardware, well and good.

The solution I proposed has the advantage of existing entirely within the GroupWise system, and doesn't have special hardware requirements. There's also no licensing costs, since GroupWise is licensed per mailbox - Novell doesn't care how many agents you run.
The GWIA will ignore the "general use" NIC because the ip address was not put into console one, only the address of the TEAMED NIC pair. Any Cisco or Nortel switch will do, what kind of hardware are you running?
No, the GWIA will NOT, by default, ignore a given NIC for outbound messages. By default, it will use any available address when sending. See the Novell GroupWise v6.5 Administration Guide at, specifically Page 641.

In order to force the GWIA to bind to a specific IP address for outbound E-Mail, you must choose the "Bijnd to TCP/IP Address at Connection Time" option under the SMTP/MIME tab (Settings panel) of the GWIA properties.

I note in passing that GWIA will still listen on all TCP/IP addresses on the machine for incoming E-Mail. There is no way to override that behaviour.
Good point, Block the groupwise ports on the 3rd NIC and it will be forced to transmit over the TEAMED NICS or just take it out and use the TEAMED NICS for everything. The work is done at the switch groupwise has nothing to do with the traffic flow.
ShineOnConnect With a Mentor Commented:
How 'bout this idea - put GWIA in a DMZ on its own server, so ANY SMTP outgoing will likely be a worm.  The comm between GWIA and the MTA is not SMTP.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.