forefront threat management gateway

[itsegypt]

One of my clients has forefront threat management gateway, version: 7.0.9193.500
They uses it as a proxy..

This proxy can use more than IP address as a gateway...

When they use one of them, it works properly but for limited time, after that stopped with "authentication failed" when they tried to access the POP3 ...

- Long time ago, I've added this IP to the IP allowed list in the csf firewall...

And when I search for any blocking on the server, I can't find any blocking...

I recommended modifying the gateway IP, and I also added the new IP address to the allowed IPs on the server.
It worked fine, and it also blocked within couple of days with the same error message "Authentication Failed", with the POP3.

They can access http, and https without any problem, they can see that the email ports working...
They just have authentication failed in their email clients software, and they can access webmail from the same IP address...

Anyone has anything to be said in this matter!!?

 

[cPanelMichael]

Hello

Is cPHulk brute force detection enabled on this server? What do you see in /var/log/maillog when the authentication fails?

Thank you.