DLP Email prevent server is rejecting upstream MTA connections

Products

Data Loss Prevention Network Prevent for Email Data Loss Prevention Data Loss Prevention Core Package

Issue/Introduction

Emails are not passing through DLP email prevent server and you can see in logs that DLP email prevent is rejecting upstream MTA connections.

Following errors are seen in email prevent logs -

SmtpPrevent_operational0.log -

[SEVERE] (SMTP_CONNECTION.5200) Connection rejected from unauthorized host (tid=xx local=/x.x.x.x remote=/x.x.x.x )

RequestProcessor0.log -

WARNING: RPT(44): Could not establish session peers.
java.io.IOException: An incoming connection from /x.x.x.x:[port] was rejected because it is not an allowed host.
at com.vontu.mta.rp.connection.ConnectionsStateManagerAction.acceptPeer(ConnectionsStateManagerAction.java:80)
at com.vontu.mta.rp.EventLoop.establishPeers(EventLoop.java:60)
at com.vontu.mta.rp.ESMTPRequestProcessorThread.run(ESMTPRequestProcessorThread.java:86)
at java.lang.Thread.run(Thread.java:748)

Environment

DLP 15.x, 16.x

Cause

This happens when upstream MTA FQDN or IP address is not added to whitelist of systems allowed to communicate with the Network Prevent for Email server.

Resolution

Follow the below steps to add upstream MTA IP address to whitelist of systems allowed to communicate with the Network Prevent for Email server. -

1. Go to System > Servers and Detectors > Overview and click on the Network Prevent for Email Server in question.

2. On the Server/Detector Detail screen that appears, click Server Settings.

3. Scroll down to the RequestProcessor.AllowHosts field.

4. Enter IP address of upstream MTA to this field. Click save and restart the email prevent server.

After this change, the email prevent server will start accepting connections from the upstream MTA.