SMTP auth not working outside of ZCS's subnet

[dvb]

Greetings.

Our ZCS server is set up to use our main server (we're an ISP) as the relay MTA. However, we still want to allow SMTP connections from authenticated users (and of course the relay MTA). Unfortunately, SMTP authentication does not work when the sender is connecting from a different subnet - they get a 554 Relay Access Denied rejection. If I put that same machine on the same subnet as ZCS, SMTP authentication works fine. It also works fine if I add the external IP address of the host to the zimbraMtaMyNetworks list, but that's not what I want.

Is this one of those unfortunate "this behavior is by design" issues or am I possibly doing something wrong?

Dave

[phoenix]

SMTP Authentication from an external client works fine otherwise I wouldn't be able to use my phone to send mail (and I can). Have you checked the authentication settings in the admin ui are correct?

[dijichi2]

trawl the logs and make sure the client is 100% definitely for-sure absolutely actually attempting smtp-auth. most problems come down to this! also make sure zimbra is set to allow non-tls smtpauth and/or the client is set to try tls.

[dvb]

Originally Posted by dijichi2

trawl the logs and make sure the client is 100% definitely for-sure absolutely actually attempting smtp-auth. most problems come down to this! also make sure zimbra is set to allow non-tls smtpauth and/or the client is set to try tls.

I tried the same clients on both a DSL connection and the internal LAN. When on the internal LAN, everything worked and the logs showed that authentication was indeed taking place.

Be that as it may, I am now suspicious of our firewall (Symantec Enterprise Firewall 6.5.3, formerly known as Raptor). Although I added the correct rules to allow access and it is working to the extent of allowing the other server to act as the default MTA for ZCS, I think the firewall is disallowing some of the information being sent when someone attempts to authenticate and it won't allow me to allow port 25 without the SMTP proxy.

We may just set up the SMTP authentication on the other server for now and see if we can fix this later when we switch to a firewall appliance.

Thanks.

Dave