Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Groupwise Sending and receiving on separate NICs

Posted on 2004-08-24
Last Modified: 2012-08-14
I am trying to establish if you can split the traffic through the Gwia to go through different network cards - incoming mail on one card and outgoing on another.
The background is:
The firewall is a Netpilot. The MX record also points to the Netpilot, which will continue to receive the mail. We want the outgoing mail to leave through a separate NIC. The purpose, as I understand it, is that, since the Netpilot is the default gateway, any (or most) virus activity inside the network, will attempt to send mail through the default gateway. This client had his domain blocked some time ago because of a virus that got in from somewhere. We can now safely block any outgoing email traffic on the netpilot if Groupwise can send mail on a different nic, ensuring that virusses cannot send mail out of the network. Hence the need to split the incoming and outgoing mail over 2 nics.
Is this possible? I posted this question on the Novell Support Forum yesterday and had no response (yet). That makes me wonder if this can be done.
Question by:benkeyser
  • 6
  • 4
LVL 34

Accepted Solution

PsiCop earned 168 total points
ID: 11882485
Well, you didn't bother to specify the VERSION of GroupWise, what SP2, if any have been applied, and what PLATFORM and VERSION you're running GroupWise on. So I'm going to assume you're using GroupWise v6.5 SP2 on a NetWare v6.5 SP2 platform. If you're not, well, you need to tell us these things - we're Experts, not mindreaders.

Short Answer: No, not easily.

Long Answer: Not easily, but you could possible do it on NetWare v6.5 thru the use of separate instances of GWIA in separate Address Spaces and each bound to a specific NIC, one configured only to send E-Mail and the other to only receive E-Mail. Or running GWIA on a *NIX platform, again with separate instances, each bound to a specific NIC with a specific config.

The issue is that the daemon that listens on Port 25 is really a separate piece of code from the GWIA itself (the GWIA handles trnaslating SMTP to GroupWise's internal format, the reverse; and routing to/from the MTA). Its going to tend to bind to all available IP addresses, and GWIA doesn't know about daemons, it just knows that if it puts an outgoing E-Mail in a certain queue directory, it vanishes and that files keep arriving in another queue directory for it to process.

In theory, you can do this. You create two different GWIAs in the GroupWise system, probably one each in their own Secondary Domain (so you're adding one or two MTAs to the mix here as well). For the Domain(s) where the users are located, you define the "Outbound" GWIA as the default destination for outbound/Internet E-Mail. This will force the MTA(s) to route all Internet E-Mail to that Domain for just that GWIA to process.

The Incoming-only GWIA does present an issue, since it can still generate SMTP-reject messages if it runs into problems, so it may still send out Internet E-mail. Or want to. I'm not sure if such traffic can be routed to the other Domain.
LVL 34

Expert Comment

ID: 11882681
BTW, you may have noted that GroupWise does not have its own TA under the E-Mail heading. If you'd like to help change this, then a nice (free) message in the New Topics request area would be helpful. http://www.experts-exchange.com/Community_Support/New_Topics/

Assisted Solution

gilesjp earned 166 total points
ID: 11884625
Hi, Good question. Try this it should work.

1) You need three NIC's set two of the NIC's up as teaming so they will have       the same IP Address.
2) Enter this address into the GWIA ( Using Console One browse to GWIA in NDS mode go to properties--> Groupwise Tab --> network address) and set up in DNS.
3) The cables from the teamed NIC's need to be pluged into port A and B of the switch.
4) Set an Access list for inbound traffic on port A
5) Set an Access list for outbound traffic on port B
6) Use the 3rd NIC for the general IP address of the server so other stuff on the server can run unhampered.

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

LVL 34

Expert Comment

ID: 11884658
The trouble with that arrangement is that you have no control over which IP address GroupWise will use for what. So it may very well try to use the inbound-only IP address for outbound traffic and start queueing up a lot of E-Mail because it thinks its running into a 450 Host Down situation.

Expert Comment

ID: 11884896
This will work.  Groupwise is ignorant of the entire set up. The switch will do the work. Groupwise doesn't decide anything. There is no inbound only address
because the inbound and outbound NIC's have the same address they are TEAMED. The switch will route the traffic to the proper NIC thought the access list on the ports. Groupwise just thinks there is only one NIC.
LVL 34

Expert Comment

ID: 11885014
Ah, I see what you're getting at. You still need to prevent the GWIA from binding to the "general use" NIC.

And it is also dependent on having NICs capable of Teaming (altho most are, since its mainly done in software) and on a switching infrastructure that can control access with that granularity. If you have that hardware, well and good.

The solution I proposed has the advantage of existing entirely within the GroupWise system, and doesn't have special hardware requirements. There's also no licensing costs, since GroupWise is licensed per mailbox - Novell doesn't care how many agents you run.

Expert Comment

ID: 11885283
The GWIA will ignore the "general use" NIC because the ip address was not put into console one, only the address of the TEAMED NIC pair. Any Cisco or Nortel switch will do, what kind of hardware are you running?
LVL 34

Expert Comment

ID: 11885563
No, the GWIA will NOT, by default, ignore a given NIC for outbound messages. By default, it will use any available address when sending. See the Novell GroupWise v6.5 Administration Guide at http://www.novell.com/documentation/gw65/index.html, specifically Page 641.

In order to force the GWIA to bind to a specific IP address for outbound E-Mail, you must choose the "Bijnd to TCP/IP Address at Connection Time" option under the SMTP/MIME tab (Settings panel) of the GWIA properties.

I note in passing that GWIA will still listen on all TCP/IP addresses on the machine for incoming E-Mail. There is no way to override that behaviour.

Expert Comment

ID: 11887192
Good point, Block the groupwise ports on the 3rd NIC and it will be forced to transmit over the TEAMED NICS or just take it out and use the TEAMED NICS for everything. The work is done at the switch groupwise has nothing to do with the traffic flow.
LVL 35

Assisted Solution

ShineOn earned 166 total points
ID: 11894002
How 'bout this idea - put GWIA in a DMZ on its own server, so ANY SMTP outgoing will likely be a worm.  The comm between GWIA and the MTA is not SMTP.
LVL 34

Expert Comment

ID: 12001222

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Netware 6.5 on VMWare with VMTools 5 1,904
WIN7 connect  to OLD  netware 4.1 server protocol 5 1,061
eDirectory 8.8 SP8 Install Guidance 3 597
The business world is becoming increasingly integrated with tech. It’s not just for a select few anymore — but what about if you have a small business? It may be easier than you think to integrate technology into your small business, and it’s likely…
ConnectWise and their customers need to ensure critical alerts automatically reach the right person at the right time. MSP superheros efficiently respond to these alerts key is providing automatic, intelligent alerting that generates a complete audi…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question