Christian, It is most likely that one of the mail servers can't reverse-resolve the IP of the other one to a name. So the mailserver sits for ages waiting for the DNS queries to timeout, and in the meantime firewall-1 times out the connection. So by the time the mailserver gives up waiting for DNS and tries to send it's next packet through, FW1 has dropped the connection, and so drops the packet 'Unknown established TCP packet'.
To fix it, make sure both mailservers known the other mailserver's IP-Name mapping by adding an entry to /etc/hosts or c:\winnt\system32\drivers\etc\hosts. This is maily for unix but lack of name resolution does strange things to NT too. Darryl. >> >>---------------------------------------------------------------------- >> >>Date: Tue, 5 Mar 2002 09:16:33 +0100 >>From: Christian Betz <[EMAIL PROTECTED]> <mailto:[EMAIL PROTECTED]> >>Subject: SMTP server communication and "unknown established TCP pac ket" >> >>Hi, >> >>the mailserver in DMZ cannot transfer Emails to internal Mailserver. FW-1 log entry: >drop; unknown established TCP packet. I know what this means, but how can I change >this? Everything is allowed between both servers. I already tested with NAT, but >without positiv results. > ================================================= To set vacation, Out Of Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
