Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 15 replies
  • Answers 1 answer
  • Subscribers 26 subscribers
  • Views 6688 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Outlook 2010 client not able to connect to provider

nicolebaumeler
Hello to all,
 
Situation:
I have an outlook client (2010) in the internal network that has to connect to an external e-mail provider to send and fetch e-mail.
The Sophos XG is in transparent Mail delivery mode (not MTA).

I have a business application rule in place that scans traffic: imap/imaps/pop/pops/smtp/smtps (the services to scan are predefined and can be selected by checkbos).
 
Until now the e-mail provider delivers mail still unencryptet, so POP = 110, SMTP = 25 and everything is working fine: the outlook client connects to the e-mail provider, send and receive e-mail is no problem.
 
 
By end of this month the provider will switch to encryptet mail and turn off unencryptet protocols:
POP will be POPS = 995
SMTP will be switched to SMTPS = 465
 
The problem is: whenever I change the outlook client settings, the client is not able to connect to the provider anymore.
 
I tried to implement different network and also business application rules that would allow the client to pass on the given ports (995/465), but nothing I tried is working.
Please help!


This thread was automatically locked due to age.
  • 0

    Hi,

    Have you installed the CA on each device?

    Also the XG does not currently recognise 587 as SMTPs only 465, I am hoping the MR-6 will add 587 the mail business rule SMTPS ports.

    Ian

     

    Edit : corrected wrong port information.

  • 0 in reply to rfcat_vk

    Yes, CA is installed on each device.

    Wow... XG does not support 465? That is absolutely nogo..! The provider is changing per end of June, I have to make this work....

  • 0 in reply to nicolebaumeler

    Is there any workaround for the missing 465 port?

  • 0 in reply to nicolebaumeler

    Hi,

    Your question raises an interesting point that I need to test in my setup is how is the smtp/s traffic being sent? I have a mail business rule but that is setup to scan incoming traffic.

    Well, further testing indicates I have the ports back to front, the XG does not support 587 using the business rule.

    The pop/imap business rule can be configured to scan smtp/s when setup as a LAN -> WAN rule.

     

    My apologies for providing incorrect information. I will edit the post.

    Ian 

  • 0 in reply to rfcat_vk

    Hello Ian

    Thank you for testing and your input! meanwhile I did some further tests with a different mail client program, test szenario and outcome:

    Szenario 1

    Mail client installation

    • installation of Thunderbird as e-mail client program
    • import of XG SSL certificate into Thunderbird

     

    Configuration of thunderbird same as in Outlook 2010:

    pop server: pop3s.bluewin.ch port 995

    smtp server: smtpauths.bluewin.ch port 465

     

    Test pop/smtp connectivity:

    -> works like a charm!

     

    Szenario 2

    Mail client installation

    • installation of Outlook 2010 as e-mail client program
    • import of XG SSL certificate into the windows certificate trust store

     

    Configuration of Outlook:

    pop server: pop3s.bluewin.ch port 995

    smtp server: smtpauths.bluewin.ch port 465

     

    Test pop/smtp connectivity:

    --> No connection

    Sorry, windows is in german. Translated:

    "your server does not support the required connectivity encryption type. Try to change the connectivity encryption type or contact yourt system administrator or e-mail provider."

     

    Here my Sophos settings:

    1. Firewall business application rule

     

    2. E-Mail policies

     

    3. Mail general settings

     

    I have also an Outlook 2010 test client that is directly connected to the internet with exactly the same outlook configuration as inhouse:

    it works perfect!

     

    Is there any help on this please?

    I have no ideas anymore...

  • 0 in reply to nicolebaumeler

    Hi Nicole,

    I can't see what your outlook configuration is, do you have use SSL enabled?

    When you open log viewer in the mail window and try to connect what errors do you see?

    Ian

  • 0 in reply to rfcat_vk

    Hi Ian

    The outlook configuration looks like this:

     

    I don't know what you mean by log viewer in the mail window? when I try to connect the connect window is open and delivers the error I have posted above.

    see again here:

  • 0 in reply to nicolebaumeler

    Hi Nicole,

    on the XG using the logviewer you select mail from the menu.

    Also I have outlook 2016 run ning only wife's MBP using iMAPs and SMTPs and she can send and receive emails using a similar mail business rule to yours.

    Ian

  • 0 in reply to rfcat_vk

    Hi Ian

     

    thanks for replying again! I appreciate every help very much!

    after I've seen your post this morning I have completely re-installed the client host - setup from scratch with new windows 7 and office. but... no luck. it is not a failure in OS or office outlook, I get exactly the same errors as yesterday and before.

     

    I checked the mail log, but this stays empty.

    I checked "all logs" too. a lot of entries, but no block during the time I have tested the connectivity (see below). there were some country blocks 5 minutes ago, but disabling the rule showd, it is not related to my outlook errors.

    any ideas?

    the certificate is in the windows trusted store still - or yet, as I deploy it via group policy.

     

  • 0 in reply to nicolebaumeler

    Hi Nicole,

    most of those entries are nothing to do with mail. There is one entry for mail using port 465 which has gone through.

    In logviewer when you click the email from the drop down menu you should see a report like this

    Please excuse the funny report, I am hoping there will be a fix in MR-6 that will stop this.

    You should see entries like queued for scanning, delivered etc.

    Also, probably a minor difference is I ticked disable legacy TLS.

    I have also found those mail policies very confusing, the SMTP policies appear to only apply to servers.

    The XG does not classify its own 465 mail as SMTPS even when it shows that in the menu of the administration notifications configuration.

    Ian