Solved

Groupwise Sending and receiving on separate NICs

Posted on 2004-08-24
13
394 Views
Last Modified: 2012-08-14
I am trying to establish if you can split the traffic through the Gwia to go through different network cards - incoming mail on one card and outgoing on another.
 
The background is:
 
The firewall is a Netpilot. The MX record also points to the Netpilot, which will continue to receive the mail. We want the outgoing mail to leave through a separate NIC. The purpose, as I understand it, is that, since the Netpilot is the default gateway, any (or most) virus activity inside the network, will attempt to send mail through the default gateway. This client had his domain blocked some time ago because of a virus that got in from somewhere. We can now safely block any outgoing email traffic on the netpilot if Groupwise can send mail on a different nic, ensuring that virusses cannot send mail out of the network. Hence the need to split the incoming and outgoing mail over 2 nics.
 
Is this possible? I posted this question on the Novell Support Forum yesterday and had no response (yet). That makes me wonder if this can be done.
0
Comment
Question by:benkeyser
  • 6
  • 4
13 Comments
 
LVL 34

Accepted Solution

by:
PsiCop earned 168 total points
ID: 11882485
Well, you didn't bother to specify the VERSION of GroupWise, what SP2, if any have been applied, and what PLATFORM and VERSION you're running GroupWise on. So I'm going to assume you're using GroupWise v6.5 SP2 on a NetWare v6.5 SP2 platform. If you're not, well, you need to tell us these things - we're Experts, not mindreaders.

Short Answer: No, not easily.

Long Answer: Not easily, but you could possible do it on NetWare v6.5 thru the use of separate instances of GWIA in separate Address Spaces and each bound to a specific NIC, one configured only to send E-Mail and the other to only receive E-Mail. Or running GWIA on a *NIX platform, again with separate instances, each bound to a specific NIC with a specific config.

The issue is that the daemon that listens on Port 25 is really a separate piece of code from the GWIA itself (the GWIA handles trnaslating SMTP to GroupWise's internal format, the reverse; and routing to/from the MTA). Its going to tend to bind to all available IP addresses, and GWIA doesn't know about daemons, it just knows that if it puts an outgoing E-Mail in a certain queue directory, it vanishes and that files keep arriving in another queue directory for it to process.

In theory, you can do this. You create two different GWIAs in the GroupWise system, probably one each in their own Secondary Domain (so you're adding one or two MTAs to the mix here as well). For the Domain(s) where the users are located, you define the "Outbound" GWIA as the default destination for outbound/Internet E-Mail. This will force the MTA(s) to route all Internet E-Mail to that Domain for just that GWIA to process.

The Incoming-only GWIA does present an issue, since it can still generate SMTP-reject messages if it runs into problems, so it may still send out Internet E-mail. Or want to. I'm not sure if such traffic can be routed to the other Domain.
0
 
LVL 34

Expert Comment

by:PsiCop
ID: 11882681
BTW, you may have noted that GroupWise does not have its own TA under the E-Mail heading. If you'd like to help change this, then a nice (free) message in the New Topics request area would be helpful. http://www.experts-exchange.com/Community_Support/New_Topics/
0
 

Assisted Solution

by:gilesjp
gilesjp earned 166 total points
ID: 11884625
Hi, Good question. Try this it should work.

1) You need three NIC's set two of the NIC's up as teaming so they will have       the same IP Address.
2) Enter this address into the GWIA ( Using Console One browse to GWIA in NDS mode go to properties--> Groupwise Tab --> network address) and set up in DNS.
3) The cables from the teamed NIC's need to be pluged into port A and B of the switch.
4) Set an Access list for inbound traffic on port A
5) Set an Access list for outbound traffic on port B
6) Use the 3rd NIC for the general IP address of the server so other stuff on the server can run unhampered.

Thanks!
0
 
LVL 34

Expert Comment

by:PsiCop
ID: 11884658
The trouble with that arrangement is that you have no control over which IP address GroupWise will use for what. So it may very well try to use the inbound-only IP address for outbound traffic and start queueing up a lot of E-Mail because it thinks its running into a 450 Host Down situation.
0
 

Expert Comment

by:gilesjp
ID: 11884896
This will work.  Groupwise is ignorant of the entire set up. The switch will do the work. Groupwise doesn't decide anything. There is no inbound only address
because the inbound and outbound NIC's have the same address they are TEAMED. The switch will route the traffic to the proper NIC thought the access list on the ports. Groupwise just thinks there is only one NIC.
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 34

Expert Comment

by:PsiCop
ID: 11885014
Ah, I see what you're getting at. You still need to prevent the GWIA from binding to the "general use" NIC.

And it is also dependent on having NICs capable of Teaming (altho most are, since its mainly done in software) and on a switching infrastructure that can control access with that granularity. If you have that hardware, well and good.

The solution I proposed has the advantage of existing entirely within the GroupWise system, and doesn't have special hardware requirements. There's also no licensing costs, since GroupWise is licensed per mailbox - Novell doesn't care how many agents you run.
0
 

Expert Comment

by:gilesjp
ID: 11885283
The GWIA will ignore the "general use" NIC because the ip address was not put into console one, only the address of the TEAMED NIC pair. Any Cisco or Nortel switch will do, what kind of hardware are you running?
0
 
LVL 34

Expert Comment

by:PsiCop
ID: 11885563
No, the GWIA will NOT, by default, ignore a given NIC for outbound messages. By default, it will use any available address when sending. See the Novell GroupWise v6.5 Administration Guide at http://www.novell.com/documentation/gw65/index.html, specifically Page 641.

In order to force the GWIA to bind to a specific IP address for outbound E-Mail, you must choose the "Bijnd to TCP/IP Address at Connection Time" option under the SMTP/MIME tab (Settings panel) of the GWIA properties.

I note in passing that GWIA will still listen on all TCP/IP addresses on the machine for incoming E-Mail. There is no way to override that behaviour.
0
 

Expert Comment

by:gilesjp
ID: 11887192
Good point, Block the groupwise ports on the 3rd NIC and it will be forced to transmit over the TEAMED NICS or just take it out and use the TEAMED NICS for everything. The work is done at the switch groupwise has nothing to do with the traffic flow.
0
 
LVL 35

Assisted Solution

by:ShineOn
ShineOn earned 166 total points
ID: 11894002
How 'bout this idea - put GWIA in a DMZ on its own server, so ANY SMTP outgoing will likely be a worm.  The comm between GWIA and the MTA is not SMTP.
0
 
LVL 34

Expert Comment

by:PsiCop
ID: 12001222
Hello?
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Novell DNS in conjunction with Microsott DNS 3 274
Export GroupWise Calendar 2 992
Novell Login Scripts 3 687
Novell Netware 3.X in a HyperV session 3 2,028
HOW TO: Upload an ISO image to a VMware datastore for use with VMware vSphere Hypervisor 6.5 (ESXi 6.5) using the vSphere Host Client, and checking its MD5 checksum signature is correct.  It's a good idea to compare checksums, because many installat…
A safe way to clean winsxs folder from your windows server 2008 R2 editions
This video discusses moving either the default database or any database to a new volume.
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now