MAL shows status as "Processing Status" for messages

[Alper Kocal]

Hi,

Firewall is delivering emails to SMG(v10.7.3.-5) but we just see (Processing Status) on Audit Logs. 
Especially, the two different IP have this issue. We've closed most options on SMG but the issue is stil going on.

We've opened case but no return yet.
Anyone have an idea or advice?

Best Regards,

[alexander-smg]

I cannot see the pic.  Its too small

 

[Alper Kocal]

[alexander-smg]

It looks like the session is not fully getting to your smg? Is any messages getting delivered.  Try running your smg with only one nic.

[Alper Kocal]

yes, you are right but there was FortiMail after SMG and the customer said that then there was no problem.
As you said we have only one nic.

We've started packet capture and listening.

[Thomas Anderson]

Something is really suspicious about this message:  no sender and no recipient information!?
The "Processing Status" indicates that the message hasn't been through any of those phases yet.
It's almost as if, at the time you did the MAL query, the connection was in progress, but was still in the midst of the SMTP conversation. 
(notice:  you have the connecting IPs information, and an AuditID has been generated and associated with the message, but there is no other header info sender, recipient, etc).

Packet capture seems like a bit of a sledge hammer, at this point (and might not solve the mystery).
Before going down that path, why don't you try performing another MAL query, using the AuditID  (the "ID" field in your pic) as the argument?

[alexander-smg]

Is that fortimail in transparent mode???

[Steven R]

There can be a few reasons for messages to show as Processing Status. We would need a case opened and evidence provided to determine the cause. Which it sounds like you have already done.

------------------------------
Strategic Support Engineer
Broadcom
------------------------------

[alexander-smg]

I bet it’s the competitor POS fortimail product. Lol

[Alper Kocal]

Yes, We've created a case and waiting return but when we analyze packet capture, we saw "alert (level fatal description unknown ca)" We can share the screenshot tomorrow if you want.

We are not sure that the source of the problem is SMG.

Best Regards.

[alexander-smg]

Get rid of the fortimail

[alexander-smg]

Yes I wanna see the fortimail screen shots of errors please. And more pics of the smg errors. Pls.

[Thomas Anderson]

Support will be able to tell for sure, but given the alert text, it sure sounds like the certificate being used by the sender is signed by an unknown CA.
From the other symptoms you described above, I'm going to guess that you need to install/add the appropriate CA certificate into the SMG so it can verify the certificate that is being passed during the SMTP/TLS conversation.

[alexander-smg]

That's not right

 

[Thomas Anderson]

It could be wrong, but the facts sure seem to point that way:
You have a MAL record that contains an ID and nothing else.
The audit ID is generated during connection.
The trace indicates the TLS conversation failed due to an invalid cert.
The message doesn't appear to have been received or processed.

Fix the TLS conversation so the message can be received, then see how things go.
Or I could have missed something, and I'm completely wrong.

[alexander-smg]

Get rid of fortimail.

[Alper Kocal]

I've updated CA and then i tried again, the result didn't changed.
We are planning that get rid of fortimail :)

[alexander-smg]

 

Is the fortimail in transparent mode?

 

Get rid if it

[Alper Kocal]

nope, it is doing sandbox, because of this the customer wants to use it.

[alexander-smg]

Get rid of it.  booooooooooo

[Alper Kocal]

• To add a CA or an intermediate certificate
• In the Control Center, click Administration > Settings > Certificates.
• Click the Certificate Authority tab.
• Click Update.
• On the Update CA Certificates page, click Browse.
• Locate and select the file that contains the CA or intermediate certificate.
• Click Update.
  A status message appears at the top of the page to indicate success or failure.
  
  

[alexander-smg]

Now what.

[alexander-smg]

Is that piece of crap fortimail gone???

[Alper Kocal]

nope, we are still delivering to Fortimail and SMG works without issue..

[alexander-smg]

But it never was the smg? It was the POS fortimail device.