• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 804
  • Last Modified:

Exchange server causing sonicwall to crash

Hi,

I have an exchange server and one of the admins opened it up for anybody to connect and send email, i have (i think) locked it back down but it keep on flooding port 25 and router keeps crashing aswell as email, here is the log from the router

 Firewall Event The cache is full; 6144 open connections; some will be dropped 192.168.0.13, 16088, LAN (admin) 209.191.88.254, 25, WAN

is there anyway i can get it to stop?? i have ran malwarebytes it didnt find anything

thank you
0
jonathanduane2010
Asked:
jonathanduane2010
2 Solutions
 
Greg HejlPrincipal ConsultantCommented:
run wireshark to find out which IP is not closing connections to your mail server.

then block their traffic.

you may have a setting in your firewall for 'session timeout' for inactive connections

try decreasing this.
0
 
jonathanduane2010Author Commented:
ok it was set to 15 mins i have set it to 2 mins

going to run wireshark now, but it looks like there are thousands of connections
0
 
Greg HejlPrincipal ConsultantCommented:
See if inactive timeout can be set per port number - a global setting will affect your other services

look at your connections monitor for port 25 - sift by total packets and drop the connections that are not passing traffic

notice if these connections are coming from the same networks.  

also make sure you are using good RBL lists,  barracuda, spamhuas, spamcop are some favorites
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 
jonathanduane2010Author Commented:
the connections arent coming from the same network they seem to be the destination, the source seems to be the my local exchange server
0
 
Greg HejlPrincipal ConsultantCommented:
i would try clearing smtp queue in exchange

malwarebytes has to be run in safemode - all the nastiest malwares detect all the malware scanners and pretty effectively hide themselves.
0
 
TekyguyCommented:
Check your mail queues, it maybe outgoing email - you may have a spam bot on one of your workstations inside your network.
0
 
jonathanduane2010Author Commented:
where do i check the mail queues?
0
 
dosdet2Commented:
It sounds like your server is acting as an open relay and spammers are bouncing their spam off of your server.  If that is the case, your IP will soon be black-listed if it isn't already.

What version of Exchange are you running?

We've been there & done that.
We are running Exchange 2007 and we had to configure it to not relay messages and only accept outgoing email from our domain. (Can be a list of domains too, if you have several.)
Let us know.


0
 
jonathanduane2010Author Commented:
i have exchange 2003, i have stopped relaying so relaying cant be done from the server
0

Featured Post

The Firewall Audit Checklist

Preparing for a firewall audit today is almost impossible.
AlgoSec, together with some of the largest global organizations and auditors, has created a checklist to follow when preparing for your firewall audit. Simplify risk mitigation while staying compliant all of the time!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now