OT: for Vamsoft ORF users

Hello!

I posted this message on the Vamsoft ORF newsgroup as well as here, since
several people have mentioned being ORF users.

I just bought a WatchGuard X Core e-series X550e firewall
http://www.watchguard.com/products/compare_results.asp?p1=x550e that has
spam-filtering capability http://www.watchguard.com/products/spamblocker.asp
and I want to know if it will interfere with ORF or not.

Has anyone out there used ORF in conjunction with a firewall that filters
spam, preferably a WatchGuard unit?

Would it be considered an intermediate host?

Thank you!

Gregg Hill

Lanwench
Mon May 05 06:21:58 PDT 2008

Gregg Hill <greggmhill at please do not spam me at yahoo dot com> wrote:
> Hello!
>
> I posted this message on the Vamsoft ORF newsgroup as well as here,
> since several people have mentioned being ORF users.
>
> I just bought a WatchGuard X Core e-series X550e firewall
> http://www.watchguard.com/products/compare_results.asp?p1=x550e that
> has spam-filtering capability
> http://www.watchguard.com/products/spamblocker.asp and I want to know
> if it will interfere with ORF or not.

I don't know that it will *interfere* but the more layers at which something
can get stripped out,

a) the better, as more spam will be caught/trapped
or
b) the worse, as your troubleshooting will be far more arduous

So, it's your choice, ultimately. Much depends on whether you're around to
manage this stuff, I imagine. I like to keep things simple myself. ORF works
for me on my network here (I've been running it happily for years) - but for
my clients, I prefer to outsource this to a third party service if at all
possible. That way I never have to get calls about missing mail (they can
just go to their web-based quarantine themselves).
>
> Has anyone out there used ORF in conjunction with a firewall that
> filters spam, preferably a WatchGuard unit?
>
> Would it be considered an intermediate host?

Yes.

>
> Thank you!
>
> Gregg Hill

Leythos
Mon May 05 07:43:57 PDT 2008

In article <edvYgnnrIHA.4492@TK2MSFTNGP02.phx.gbl>, "Gregg Hill"
<greggmhill at please do not spam me at yahoo dot com> says...
> Hello!
>
> I posted this message on the Vamsoft ORF newsgroup as well as here, since
> several people have mentioned being ORF users.
>
> I just bought a WatchGuard X Core e-series X550e firewall
> http://www.watchguard.com/products/compare_results.asp?p1=x550e that has
> spam-filtering capability http://www.watchguard.com/products/spamblocker.asp
> and I want to know if it will interfere with ORF or not.
>
> Has anyone out there used ORF in conjunction with a firewall that filters
> spam, preferably a WatchGuard unit?
>
> Would it be considered an intermediate host?

WG works BEFORE it reaches your server, ORF works after it reaches your
server. The two don't know each other exist. It should work just fine.

--
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)

Gregg
Mon May 05 10:23:16 PDT 2008

Leythos,

Does the WG SpamBlocker do anything to the message headers of mail it lets
through to the server? Specifically, does it change any of the IP addresses
listed in the headers?

A response in the ORF newsgroup stated:

***************************
Not the WatchGuard in particular, but I have used plenty of
multi-proxy setups w/IIS SMTP, and the variables are essentially the
same.

In rare, high-end implementations, an inline inspecting proxy is
totally transparent and its IP address is not presented to the source.
However, in most cases, the SMTP proxy will terminate the incoming
connection on its outside interface and create a new connection to
your internal mail host. The source of that new connection will be the
proxy's IP... so, yes, you do want to exclude that IP from filtering.

The WG is capable of dynamically adding headers for messages that fail
its CommTouch content inspection, and you can then look for those
headers on the ORF level.

But the questions don't stop there. Not to scare you, but some lame
proxies can create a worst-of-both-worlds scenarios. Just because you
exclude the zero-hop IP doesn't mean that the proxy has included the
one-hop IP (the original remote IP that connected to the proxy) in a
new Received: header. You may be left, at the ORF level, with no IP to
look up in DNSBLs and so on. In such cases, you end up having to
either abandon certain ORF tests or move them to an equivalent test
performed by the proxy itself. Unfortunately, in my glance at the WG
docs, they don't seem to support DNSBL lookups.

Ultimately, you'll have to experiment to see what your proxy lets ORF
see, and what is now hidden from ORF but can be handled by the WG.

***************************

I am brand new to WG and I just want to be certain I don't do more harm than
good.

Thank you again for the information...and your patience with me.

Gregg Hill



"Leythos" <void@nowhere.lan> wrote in message
news:MPG.2288e7337f93b88b9897ad@adfree.usenet.com...
> In article <edvYgnnrIHA.4492@TK2MSFTNGP02.phx.gbl>, "Gregg Hill"
> <greggmhill at please do not spam me at yahoo dot com> says...
>> Hello!
>>
>> I posted this message on the Vamsoft ORF newsgroup as well as here, since
>> several people have mentioned being ORF users.
>>
>> I just bought a WatchGuard X Core e-series X550e firewall
>> http://www.watchguard.com/products/compare_results.asp?p1=x550e that has
>> spam-filtering capability
>> http://www.watchguard.com/products/spamblocker.asp
>> and I want to know if it will interfere with ORF or not.
>>
>> Has anyone out there used ORF in conjunction with a firewall that filters
>> spam, preferably a WatchGuard unit?
>>
>> Would it be considered an intermediate host?
>
> WG works BEFORE it reaches your server, ORF works after it reaches your
> server. The two don't know each other exist. It should work just fine.
>
> --
> - Igitur qui desiderat pacem, praeparet bellum.
> - Calling an illegal alien an "undocumented worker" is like calling a
> drug dealer an "unlicensed pharmacist"
> spam999free@rrohio.com (remove 999 for proper email address)

Lanwench
Mon May 05 10:29:52 PDT 2008

Gregg Hill <greggmhill at please do not spam me at yahoo dot com> wrote:
> Leythos,
>
> Does the WG SpamBlocker do anything to the message headers of mail it
> lets through to the server? Specifically, does it change any of the
> IP addresses listed in the headers?

I'm not Leythos, but I play him on TV.

If you're using ORF, just make sure you've added the IP of the WG (or any
upstream filter) to the intermediate hosts list to be on the safe side.

>
> A response in the ORF newsgroup stated:
>
> ***************************
> Not the WatchGuard in particular, but I have used plenty of
> multi-proxy setups w/IIS SMTP, and the variables are essentially the
> same.
>
> In rare, high-end implementations, an inline inspecting proxy is
> totally transparent and its IP address is not presented to the source.
> However, in most cases, the SMTP proxy will terminate the incoming
> connection on its outside interface and create a new connection to
> your internal mail host. The source of that new connection will be the
> proxy's IP... so, yes, you do want to exclude that IP from filtering.
>
> The WG is capable of dynamically adding headers for messages that fail
> its CommTouch content inspection, and you can then look for those
> headers on the ORF level.
>
> But the questions don't stop there. Not to scare you, but some lame
> proxies can create a worst-of-both-worlds scenarios. Just because you
> exclude the zero-hop IP doesn't mean that the proxy has included the
> one-hop IP (the original remote IP that connected to the proxy) in a
> new Received: header. You may be left, at the ORF level, with no IP to
> look up in DNSBLs and so on. In such cases, you end up having to
> either abandon certain ORF tests or move them to an equivalent test
> performed by the proxy itself. Unfortunately, in my glance at the WG
> docs, they don't seem to support DNSBL lookups.
>
> Ultimately, you'll have to experiment to see what your proxy lets ORF
> see, and what is now hidden from ORF but can be handled by the WG.
>
> ***************************
>
> I am brand new to WG and I just want to be certain I don't do more
> harm than good.
>
> Thank you again for the information...and your patience with me.
>
> Gregg Hill
>
>
>
> "Leythos" <void@nowhere.lan> wrote in message
> news:MPG.2288e7337f93b88b9897ad@adfree.usenet.com...
>> In article <edvYgnnrIHA.4492@TK2MSFTNGP02.phx.gbl>, "Gregg Hill"
>> <greggmhill at please do not spam me at yahoo dot com> says...
>>> Hello!
>>>
>>> I posted this message on the Vamsoft ORF newsgroup as well as here,
>>> since several people have mentioned being ORF users.
>>>
>>> I just bought a WatchGuard X Core e-series X550e firewall
>>> http://www.watchguard.com/products/compare_results.asp?p1=x550e
>>> that has spam-filtering capability
>>> http://www.watchguard.com/products/spamblocker.asp
>>> and I want to know if it will interfere with ORF or not.
>>>
>>> Has anyone out there used ORF in conjunction with a firewall that
>>> filters spam, preferably a WatchGuard unit?
>>>
>>> Would it be considered an intermediate host?
>>
>> WG works BEFORE it reaches your server, ORF works after it reaches
>> your server. The two don't know each other exist. It should work
>> just fine. --
>> - Igitur qui desiderat pacem, praeparet bellum.
>> - Calling an illegal alien an "undocumented worker" is like calling a
>> drug dealer an "unlicensed pharmacist"
>> spam999free@rrohio.com (remove 999 for proper email address)

Gregg
Mon May 05 10:53:05 PDT 2008

Thank you! It will be awhile before I place the WG in front of my mail
server, as I am just getting started learning it. I gave up on SonicWALL
after my TZ 170 failed in 14 months, then my TZ 180 failed after about eight
months.

Gregg Hill



"Lanwench [MVP - Exchange]"
<lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in message
news:u5WhvYtrIHA.3940@TK2MSFTNGP03.phx.gbl...
> Gregg Hill <greggmhill at please do not spam me at yahoo dot com> wrote:
>> Leythos,
>>
>> Does the WG SpamBlocker do anything to the message headers of mail it
>> lets through to the server? Specifically, does it change any of the
>> IP addresses listed in the headers?
>
> I'm not Leythos, but I play him on TV.
>
> If you're using ORF, just make sure you've added the IP of the WG (or any
> upstream filter) to the intermediate hosts list to be on the safe side.
>
>>
>> A response in the ORF newsgroup stated:
>>
>> ***************************
>> Not the WatchGuard in particular, but I have used plenty of
>> multi-proxy setups w/IIS SMTP, and the variables are essentially the
>> same.
>>
>> In rare, high-end implementations, an inline inspecting proxy is
>> totally transparent and its IP address is not presented to the source.
>> However, in most cases, the SMTP proxy will terminate the incoming
>> connection on its outside interface and create a new connection to
>> your internal mail host. The source of that new connection will be the
>> proxy's IP... so, yes, you do want to exclude that IP from filtering.
>>
>> The WG is capable of dynamically adding headers for messages that fail
>> its CommTouch content inspection, and you can then look for those
>> headers on the ORF level.
>>
>> But the questions don't stop there. Not to scare you, but some lame
>> proxies can create a worst-of-both-worlds scenarios. Just because you
>> exclude the zero-hop IP doesn't mean that the proxy has included the
>> one-hop IP (the original remote IP that connected to the proxy) in a
>> new Received: header. You may be left, at the ORF level, with no IP to
>> look up in DNSBLs and so on. In such cases, you end up having to
>> either abandon certain ORF tests or move them to an equivalent test
>> performed by the proxy itself. Unfortunately, in my glance at the WG
>> docs, they don't seem to support DNSBL lookups.
>>
>> Ultimately, you'll have to experiment to see what your proxy lets ORF
>> see, and what is now hidden from ORF but can be handled by the WG.
>>
>> ***************************
>>
>> I am brand new to WG and I just want to be certain I don't do more
>> harm than good.
>>
>> Thank you again for the information...and your patience with me.
>>
>> Gregg Hill
>>
>>
>>
>> "Leythos" <void@nowhere.lan> wrote in message
>> news:MPG.2288e7337f93b88b9897ad@adfree.usenet.com...
>>> In article <edvYgnnrIHA.4492@TK2MSFTNGP02.phx.gbl>, "Gregg Hill"
>>> <greggmhill at please do not spam me at yahoo dot com> says...
>>>> Hello!
>>>>
>>>> I posted this message on the Vamsoft ORF newsgroup as well as here,
>>>> since several people have mentioned being ORF users.
>>>>
>>>> I just bought a WatchGuard X Core e-series X550e firewall
>>>> http://www.watchguard.com/products/compare_results.asp?p1=x550e
>>>> that has spam-filtering capability
>>>> http://www.watchguard.com/products/spamblocker.asp
>>>> and I want to know if it will interfere with ORF or not.
>>>>
>>>> Has anyone out there used ORF in conjunction with a firewall that
>>>> filters spam, preferably a WatchGuard unit?
>>>>
>>>> Would it be considered an intermediate host?
>>>
>>> WG works BEFORE it reaches your server, ORF works after it reaches
>>> your server. The two don't know each other exist. It should work
>>> just fine. --
>>> - Igitur qui desiderat pacem, praeparet bellum.
>>> - Calling an illegal alien an "undocumented worker" is like calling a
>>> drug dealer an "unlicensed pharmacist"
>>> spam999free@rrohio.com (remove 999 for proper email address)
>
>
>

Lanwench
Mon May 05 11:42:14 PDT 2008

Gregg Hill <greggmhill at please do not spam me at yahoo dot com> wrote:
> Thank you!

No prob.

> It will be awhile before I place the WG in front of my mail
> server, as I am just getting started learning it. I gave up on
> SonicWALL after my TZ 170 failed in 14 months, then my TZ 180 failed
> after about eight months.
>
> Gregg Hill
>
Were they under warranty/support? Always keep that current. I'm a major
SonicWALL fan and have once in a while run into a bum unit, but it's rare,
and they'll do a next day advance replacement.

I've worked with Watchguards before and find the interface very unintuitive,
but I know others who swear by them. I mainly swear AT them.

>
>
> "Lanwench [MVP - Exchange]"
> <lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in
> message news:u5WhvYtrIHA.3940@TK2MSFTNGP03.phx.gbl...
>> Gregg Hill <greggmhill at please do not spam me at yahoo dot com>
>> wrote:
>>> Leythos,
>>>
>>> Does the WG SpamBlocker do anything to the message headers of mail
>>> it lets through to the server? Specifically, does it change any of
>>> the IP addresses listed in the headers?
>>
>> I'm not Leythos, but I play him on TV.
>>
>> If you're using ORF, just make sure you've added the IP of the WG
>> (or any upstream filter) to the intermediate hosts list to be on the
>> safe side.
>>>
>>> A response in the ORF newsgroup stated:
>>>
>>> ***************************
>>> Not the WatchGuard in particular, but I have used plenty of
>>> multi-proxy setups w/IIS SMTP, and the variables are
>>> essentially the same.
>>>
>>> In rare, high-end implementations, an inline inspecting proxy
>>> is totally transparent and its IP address is not presented to the
>>> source. However, in most cases, the SMTP proxy will terminate
>>> the incoming connection on its outside interface and create a
>>> new connection to your internal mail host. The source of that new
>>> connection will be the proxy's IP... so, yes, you do want to
>>> exclude that IP from filtering. The WG is capable of dynamically adding
>>> headers for messages that
>>> fail its CommTouch content inspection, and you can then look
>>> for those headers on the ORF level.
>>>
>>> But the questions don't stop there. Not to scare you, but some
>>> lame proxies can create a worst-of-both-worlds scenarios. Just
>>> because you exclude the zero-hop IP doesn't mean that the proxy
>>> has included the one-hop IP (the original remote IP that
>>> connected to the proxy) in a new Received: header. You may be left,
>>> at the ORF level, with no IP to look up in DNSBLs and so on.
>>> In such cases, you end up having to either abandon certain ORF
>>> tests or move them to an equivalent test performed by the proxy
>>> itself. Unfortunately, in my glance at the WG docs, they don't seem
>>> to support DNSBL lookups. Ultimately, you'll have to experiment to see
>>> what your proxy lets
>>> ORF see, and what is now hidden from ORF but can be handled by the
>>> WG. ***************************
>>>
>>> I am brand new to WG and I just want to be certain I don't do more
>>> harm than good.
>>>
>>> Thank you again for the information...and your patience with me.
>>>
>>> Gregg Hill
>>>
>>>
>>>
>>> "Leythos" <void@nowhere.lan> wrote in message
>>> news:MPG.2288e7337f93b88b9897ad@adfree.usenet.com...
>>>> In article <edvYgnnrIHA.4492@TK2MSFTNGP02.phx.gbl>, "Gregg Hill"
>>>> <greggmhill at please do not spam me at yahoo dot com> says...
>>>>> Hello!
>>>>>
>>>>> I posted this message on the Vamsoft ORF newsgroup as well as
>>>>> here, since several people have mentioned being ORF users.
>>>>>
>>>>> I just bought a WatchGuard X Core e-series X550e firewall
>>>>> http://www.watchguard.com/products/compare_results.asp?p1=x550e
>>>>> that has spam-filtering capability
>>>>> http://www.watchguard.com/products/spamblocker.asp
>>>>> and I want to know if it will interfere with ORF or not.
>>>>>
>>>>> Has anyone out there used ORF in conjunction with a firewall that
>>>>> filters spam, preferably a WatchGuard unit?
>>>>>
>>>>> Would it be considered an intermediate host?
>>>>
>>>> WG works BEFORE it reaches your server, ORF works after it reaches
>>>> your server. The two don't know each other exist. It should work
>>>> just fine. --
>>>> - Igitur qui desiderat pacem, praeparet bellum.
>>>> - Calling an illegal alien an "undocumented worker" is like
>>>> calling a drug dealer an "unlicensed pharmacist"
>>>> spam999free@rrohio.com (remove 999 for proper email address)

Gregg
Mon May 05 12:14:58 PDT 2008

The TZ 170 was an NFR out of warranty and literally fried., so I got the TZ
180 NFR, and it died while in warranty, so I got an RMA. Convincing their
Indian tech support that the TZ 180 unit had a problem took almost two
weeks...not impressive.

Anyway, I'll try WG and see what happens.

Gregg Hill


"Lanwench [MVP - Exchange]"
<lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in message
news:ebtWdKurIHA.3680@TK2MSFTNGP05.phx.gbl...
> Gregg Hill <greggmhill at please do not spam me at yahoo dot com> wrote:
>> Thank you!
>
> No prob.
>
>> It will be awhile before I place the WG in front of my mail
>> server, as I am just getting started learning it. I gave up on
>> SonicWALL after my TZ 170 failed in 14 months, then my TZ 180 failed
>> after about eight months.
>>
>> Gregg Hill
>>
> Were they under warranty/support? Always keep that current. I'm a major
> SonicWALL fan and have once in a while run into a bum unit, but it's rare,
> and they'll do a next day advance replacement.
>
> I've worked with Watchguards before and find the interface very
> unintuitive, but I know others who swear by them. I mainly swear AT them.
>
>>
>>
>> "Lanwench [MVP - Exchange]"
>> <lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in
>> message news:u5WhvYtrIHA.3940@TK2MSFTNGP03.phx.gbl...
>>> Gregg Hill <greggmhill at please do not spam me at yahoo dot com>
>>> wrote:
>>>> Leythos,
>>>>
>>>> Does the WG SpamBlocker do anything to the message headers of mail
>>>> it lets through to the server? Specifically, does it change any of
>>>> the IP addresses listed in the headers?
>>>
>>> I'm not Leythos, but I play him on TV.
>>>
>>> If you're using ORF, just make sure you've added the IP of the WG
>>> (or any upstream filter) to the intermediate hosts list to be on the
>>> safe side.
>>>>
>>>> A response in the ORF newsgroup stated:
>>>>
>>>> ***************************
>>>> Not the WatchGuard in particular, but I have used plenty of
>>>> multi-proxy setups w/IIS SMTP, and the variables are
>>>> essentially the same.
>>>>
>>>> In rare, high-end implementations, an inline inspecting proxy
>>>> is totally transparent and its IP address is not presented to the
>>>> source. However, in most cases, the SMTP proxy will terminate
>>>> the incoming connection on its outside interface and create a
>>>> new connection to your internal mail host. The source of that new
>>>> connection will be the proxy's IP... so, yes, you do want to
>>>> exclude that IP from filtering. The WG is capable of dynamically adding
>>>> headers for messages that
>>>> fail its CommTouch content inspection, and you can then look
>>>> for those headers on the ORF level.
>>>>
>>>> But the questions don't stop there. Not to scare you, but some
>>>> lame proxies can create a worst-of-both-worlds scenarios. Just
>>>> because you exclude the zero-hop IP doesn't mean that the proxy
>>>> has included the one-hop IP (the original remote IP that
>>>> connected to the proxy) in a new Received: header. You may be left,
>>>> at the ORF level, with no IP to look up in DNSBLs and so on.
>>>> In such cases, you end up having to either abandon certain ORF
>>>> tests or move them to an equivalent test performed by the proxy
>>>> itself. Unfortunately, in my glance at the WG docs, they don't seem
>>>> to support DNSBL lookups. Ultimately, you'll have to experiment to see
>>>> what your proxy lets
>>>> ORF see, and what is now hidden from ORF but can be handled by the
>>>> WG. ***************************
>>>>
>>>> I am brand new to WG and I just want to be certain I don't do more
>>>> harm than good.
>>>>
>>>> Thank you again for the information...and your patience with me.
>>>>
>>>> Gregg Hill
>>>>
>>>>
>>>>
>>>> "Leythos" <void@nowhere.lan> wrote in message
>>>> news:MPG.2288e7337f93b88b9897ad@adfree.usenet.com...
>>>>> In article <edvYgnnrIHA.4492@TK2MSFTNGP02.phx.gbl>, "Gregg Hill"
>>>>> <greggmhill at please do not spam me at yahoo dot com> says...
>>>>>> Hello!
>>>>>>
>>>>>> I posted this message on the Vamsoft ORF newsgroup as well as
>>>>>> here, since several people have mentioned being ORF users.
>>>>>>
>>>>>> I just bought a WatchGuard X Core e-series X550e firewall
>>>>>> http://www.watchguard.com/products/compare_results.asp?p1=x550e
>>>>>> that has spam-filtering capability
>>>>>> http://www.watchguard.com/products/spamblocker.asp
>>>>>> and I want to know if it will interfere with ORF or not.
>>>>>>
>>>>>> Has anyone out there used ORF in conjunction with a firewall that
>>>>>> filters spam, preferably a WatchGuard unit?
>>>>>>
>>>>>> Would it be considered an intermediate host?
>>>>>
>>>>> WG works BEFORE it reaches your server, ORF works after it reaches
>>>>> your server. The two don't know each other exist. It should work
>>>>> just fine. --
>>>>> - Igitur qui desiderat pacem, praeparet bellum.
>>>>> - Calling an illegal alien an "undocumented worker" is like
>>>>> calling a drug dealer an "unlicensed pharmacist"
>>>>> spam999free@rrohio.com (remove 999 for proper email address)
>
>
>
>

Lanwench
Mon May 05 13:04:17 PDT 2008

Gregg Hill <greggmhill at please do not spam me at yahoo dot com> wrote:
> The TZ 170 was an NFR out of warranty and literally fried., so I got
> the TZ 180 NFR, and it died while in warranty, so I got an RMA.
> Convincing their Indian tech support that the TZ 180 unit had a
> problem took almost two weeks...not impressive.
>
> Anyway, I'll try WG and see what happens.
>
> Gregg Hill

If you have an NFR copy it sounds like you're a Sonicwall partner - in which
case India shouldn't be involved. I've never had an issue returning a busted
unit & I've always gotten North American call centers. Just my $.02.

>
>
> "Lanwench [MVP - Exchange]"
> <lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in
> message news:ebtWdKurIHA.3680@TK2MSFTNGP05.phx.gbl...
>> Gregg Hill <greggmhill at please do not spam me at yahoo dot com>
>> wrote:
>>> Thank you!
>>
>> No prob.
>>
>>> It will be awhile before I place the WG in front of my mail
>>> server, as I am just getting started learning it. I gave up on
>>> SonicWALL after my TZ 170 failed in 14 months, then my TZ 180 failed
>>> after about eight months.
>>>
>>> Gregg Hill
>>>
>> Were they under warranty/support? Always keep that current. I'm a
>> major SonicWALL fan and have once in a while run into a bum unit,
>> but it's rare, and they'll do a next day advance replacement.
>>
>> I've worked with Watchguards before and find the interface very
>> unintuitive, but I know others who swear by them. I mainly swear AT
>> them.
>>>
>>>
>>> "Lanwench [MVP - Exchange]"
>>> <lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in
>>> message news:u5WhvYtrIHA.3940@TK2MSFTNGP03.phx.gbl...
>>>> Gregg Hill <greggmhill at please do not spam me at yahoo dot com>
>>>> wrote:
>>>>> Leythos,
>>>>>
>>>>> Does the WG SpamBlocker do anything to the message headers of mail
>>>>> it lets through to the server? Specifically, does it change any of
>>>>> the IP addresses listed in the headers?
>>>>
>>>> I'm not Leythos, but I play him on TV.
>>>>
>>>> If you're using ORF, just make sure you've added the IP of the WG
>>>> (or any upstream filter) to the intermediate hosts list to be on
>>>> the safe side.
>>>>>
>>>>> A response in the ORF newsgroup stated:
>>>>>
>>>>> ***************************
>>>>> Not the WatchGuard in particular, but I have used plenty of
>>>>> multi-proxy setups w/IIS SMTP, and the variables are
>>>>> essentially the same.
>>>>>
>>>>> In rare, high-end implementations, an inline inspecting
>>>>> proxy is totally transparent and its IP address is not presented to
>>>>> the
>>>>> source. However, in most cases, the SMTP proxy will terminate
>>>>> the incoming connection on its outside interface and create a
>>>>> new connection to your internal mail host. The source of that new
>>>>> connection will be the proxy's IP... so, yes, you do want to
>>>>> exclude that IP from filtering. The WG is capable of dynamically
>>>>> adding headers for messages that
>>>>> fail its CommTouch content inspection, and you can then look
>>>>> for those headers on the ORF level.
>>>>>
>>>>> But the questions don't stop there. Not to scare you, but some
>>>>> lame proxies can create a worst-of-both-worlds scenarios. Just
>>>>> because you exclude the zero-hop IP doesn't mean that the proxy
>>>>> has included the one-hop IP (the original remote IP that
>>>>> connected to the proxy) in a new Received: header. You may be
>>>>> left, at the ORF level, with no IP to look up in DNSBLs and so
>>>>> on.
>>>>> In such cases, you end up having to either abandon certain ORF
>>>>> tests or move them to an equivalent test performed by the proxy
>>>>> itself. Unfortunately, in my glance at the WG docs, they don't
>>>>> seem to support DNSBL lookups. Ultimately, you'll have to experiment
>>>>> to see what your proxy lets
>>>>> ORF see, and what is now hidden from ORF but can be handled by the
>>>>> WG. ***************************
>>>>>
>>>>> I am brand new to WG and I just want to be certain I don't do more
>>>>> harm than good.
>>>>>
>>>>> Thank you again for the information...and your patience with me.
>>>>>
>>>>> Gregg Hill
>>>>>
>>>>>
>>>>>
>>>>> "Leythos" <void@nowhere.lan> wrote in message
>>>>> news:MPG.2288e7337f93b88b9897ad@adfree.usenet.com...
>>>>>> In article <edvYgnnrIHA.4492@TK2MSFTNGP02.phx.gbl>, "Gregg Hill"
>>>>>> <greggmhill at please do not spam me at yahoo dot com> says...
>>>>>>> Hello!
>>>>>>>
>>>>>>> I posted this message on the Vamsoft ORF newsgroup as well as
>>>>>>> here, since several people have mentioned being ORF users.
>>>>>>>
>>>>>>> I just bought a WatchGuard X Core e-series X550e firewall
>>>>>>> http://www.watchguard.com/products/compare_results.asp?p1=x550e
>>>>>>> that has spam-filtering capability
>>>>>>> http://www.watchguard.com/products/spamblocker.asp
>>>>>>> and I want to know if it will interfere with ORF or not.
>>>>>>>
>>>>>>> Has anyone out there used ORF in conjunction with a firewall
>>>>>>> that filters spam, preferably a WatchGuard unit?
>>>>>>>
>>>>>>> Would it be considered an intermediate host?
>>>>>>
>>>>>> WG works BEFORE it reaches your server, ORF works after it
>>>>>> reaches your server. The two don't know each other exist. It
>>>>>> should work just fine. --
>>>>>> - Igitur qui desiderat pacem, praeparet bellum.
>>>>>> - Calling an illegal alien an "undocumented worker" is like
>>>>>> calling a drug dealer an "unlicensed pharmacist"
>>>>>> spam999free@rrohio.com (remove 999 for proper email address)

Leythos
Mon May 05 13:56:56 PDT 2008

In article <u5WhvYtrIHA.3940@TK2MSFTNGP03.phx.gbl>,
lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com says...
> Gregg Hill <greggmhill at please do not spam me at yahoo dot com> wrote:
> > Leythos,
> >
> > Does the WG SpamBlocker do anything to the message headers of mail it
> > lets through to the server? Specifically, does it change any of the
> > IP addresses listed in the headers?
>
> I'm not Leythos, but I play him on TV.

LOL - I can't answer the question because I have not looked at the
message header to determine any changes to the inbound emails.

I'm sure, the OP could disable ORF, use the Spam filter in WG, then
check the messages and determine what header changes are in place.

I know that we have used WG Spam Filter while also running GFI Mail
Essentials and it's not be an issue at all.

--
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)

Leythos
Mon May 05 13:58:36 PDT 2008

In article <#0DgQRurIHA.4544@TK2MSFTNGP04.phx.gbl>, "Gregg Hill"
<greggmhill at please do not spam me at yahoo dot com> says...
> The TZ 170 was an NFR out of warranty and literally fried., so I got the TZ
> 180 NFR, and it died while in warranty, so I got an RMA. Convincing their
> Indian tech support that the TZ 180 unit had a problem took almost two
> weeks...not impressive.

NFR should mean you are a partner/reseller and that means you don't use
the standard support channels.

Since you have support on the WG unit, call them and ask your questions
and you should get the answers you want.

--
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)

Gregg
Mon May 05 16:34:21 PDT 2008

Yes, I am a partner, but India is what I got when I called support and told
them I was a partner.

Oh, well, that one is a moo point now.

Gregg Hill



"Lanwench [MVP - Exchange]"
<lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in message
news:%23sDkRvurIHA.4544@TK2MSFTNGP04.phx.gbl...
> Gregg Hill <greggmhill at please do not spam me at yahoo dot com> wrote:
>> The TZ 170 was an NFR out of warranty and literally fried., so I got
>> the TZ 180 NFR, and it died while in warranty, so I got an RMA.
>> Convincing their Indian tech support that the TZ 180 unit had a
>> problem took almost two weeks...not impressive.
>>
>> Anyway, I'll try WG and see what happens.
>>
>> Gregg Hill
>
> If you have an NFR copy it sounds like you're a Sonicwall partner - in
> which case India shouldn't be involved. I've never had an issue returning
> a busted unit & I've always gotten North American call centers. Just my
> $.02.
>
>>
>>
>> "Lanwench [MVP - Exchange]"
>> <lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in
>> message news:ebtWdKurIHA.3680@TK2MSFTNGP05.phx.gbl...
>>> Gregg Hill <greggmhill at please do not spam me at yahoo dot com>
>>> wrote:
>>>> Thank you!
>>>
>>> No prob.
>>>
>>>> It will be awhile before I place the WG in front of my mail
>>>> server, as I am just getting started learning it. I gave up on
>>>> SonicWALL after my TZ 170 failed in 14 months, then my TZ 180 failed
>>>> after about eight months.
>>>>
>>>> Gregg Hill
>>>>
>>> Were they under warranty/support? Always keep that current. I'm a
>>> major SonicWALL fan and have once in a while run into a bum unit,
>>> but it's rare, and they'll do a next day advance replacement.
>>>
>>> I've worked with Watchguards before and find the interface very
>>> unintuitive, but I know others who swear by them. I mainly swear AT
>>> them.
>>>>
>>>>
>>>> "Lanwench [MVP - Exchange]"
>>>> <lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in
>>>> message news:u5WhvYtrIHA.3940@TK2MSFTNGP03.phx.gbl...
>>>>> Gregg Hill <greggmhill at please do not spam me at yahoo dot com>
>>>>> wrote:
>>>>>> Leythos,
>>>>>>
>>>>>> Does the WG SpamBlocker do anything to the message headers of mail
>>>>>> it lets through to the server? Specifically, does it change any of
>>>>>> the IP addresses listed in the headers?
>>>>>
>>>>> I'm not Leythos, but I play him on TV.
>>>>>
>>>>> If you're using ORF, just make sure you've added the IP of the WG
>>>>> (or any upstream filter) to the intermediate hosts list to be on
>>>>> the safe side.
>>>>>>
>>>>>> A response in the ORF newsgroup stated:
>>>>>>
>>>>>> ***************************
>>>>>> Not the WatchGuard in particular, but I have used plenty of
>>>>>> multi-proxy setups w/IIS SMTP, and the variables are
>>>>>> essentially the same.
>>>>>>
>>>>>> In rare, high-end implementations, an inline inspecting
>>>>>> proxy is totally transparent and its IP address is not presented to
>>>>>> the
>>>>>> source. However, in most cases, the SMTP proxy will terminate
>>>>>> the incoming connection on its outside interface and create a
>>>>>> new connection to your internal mail host. The source of that new
>>>>>> connection will be the proxy's IP... so, yes, you do want to
>>>>>> exclude that IP from filtering. The WG is capable of dynamically
>>>>>> adding headers for messages that
>>>>>> fail its CommTouch content inspection, and you can then look
>>>>>> for those headers on the ORF level.
>>>>>>
>>>>>> But the questions don't stop there. Not to scare you, but some
>>>>>> lame proxies can create a worst-of-both-worlds scenarios. Just
>>>>>> because you exclude the zero-hop IP doesn't mean that the proxy
>>>>>> has included the one-hop IP (the original remote IP that
>>>>>> connected to the proxy) in a new Received: header. You may be
>>>>>> left, at the ORF level, with no IP to look up in DNSBLs and so
>>>>>> on.
>>>>>> In such cases, you end up having to either abandon certain ORF
>>>>>> tests or move them to an equivalent test performed by the proxy
>>>>>> itself. Unfortunately, in my glance at the WG docs, they don't
>>>>>> seem to support DNSBL lookups. Ultimately, you'll have to experiment
>>>>>> to see what your proxy lets
>>>>>> ORF see, and what is now hidden from ORF but can be handled by the
>>>>>> WG. ***************************
>>>>>>
>>>>>> I am brand new to WG and I just want to be certain I don't do more
>>>>>> harm than good.
>>>>>>
>>>>>> Thank you again for the information...and your patience with me.
>>>>>>
>>>>>> Gregg Hill
>>>>>>
>>>>>>
>>>>>>
>>>>>> "Leythos" <void@nowhere.lan> wrote in message
>>>>>> news:MPG.2288e7337f93b88b9897ad@adfree.usenet.com...
>>>>>>> In article <edvYgnnrIHA.4492@TK2MSFTNGP02.phx.gbl>, "Gregg Hill"
>>>>>>> <greggmhill at please do not spam me at yahoo dot com> says...
>>>>>>>> Hello!
>>>>>>>>
>>>>>>>> I posted this message on the Vamsoft ORF newsgroup as well as
>>>>>>>> here, since several people have mentioned being ORF users.
>>>>>>>>
>>>>>>>> I just bought a WatchGuard X Core e-series X550e firewall
>>>>>>>> http://www.watchguard.com/products/compare_results.asp?p1=x550e
>>>>>>>> that has spam-filtering capability
>>>>>>>> http://www.watchguard.com/products/spamblocker.asp
>>>>>>>> and I want to know if it will interfere with ORF or not.
>>>>>>>>
>>>>>>>> Has anyone out there used ORF in conjunction with a firewall
>>>>>>>> that filters spam, preferably a WatchGuard unit?
>>>>>>>>
>>>>>>>> Would it be considered an intermediate host?
>>>>>>>
>>>>>>> WG works BEFORE it reaches your server, ORF works after it
>>>>>>> reaches your server. The two don't know each other exist. It
>>>>>>> should work just fine. --
>>>>>>> - Igitur qui desiderat pacem, praeparet bellum.
>>>>>>> - Calling an illegal alien an "undocumented worker" is like
>>>>>>> calling a drug dealer an "unlicensed pharmacist"
>>>>>>> spam999free@rrohio.com (remove 999 for proper email address)
>
>
>

Lanwench
Tue May 06 06:13:48 PDT 2008

Gregg Hill <greggmhill at please do not spam me at yahoo dot com> wrote:
> Yes, I am a partner, but India is what I got when I called support
> and told them I was a partner.

I'm not sure how you got there, but if you're calling from the US, phone
(888) 777-1476. Of course, the device needs to be registered under your own
Sonicwall account. Perhaps that's your issue.
>
> Oh, well, that one is a moo point now.

So, litigious bovines go to moo court ? ;-)


>
> Gregg Hill


>
>
>
> "Lanwench [MVP - Exchange]"
> <lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in
> message news:%23sDkRvurIHA.4544@TK2MSFTNGP04.phx.gbl...
>> Gregg Hill <greggmhill at please do not spam me at yahoo dot com>
>> wrote:
>>> The TZ 170 was an NFR out of warranty and literally fried., so I got
>>> the TZ 180 NFR, and it died while in warranty, so I got an RMA.
>>> Convincing their Indian tech support that the TZ 180 unit had a
>>> problem took almost two weeks...not impressive.
>>>
>>> Anyway, I'll try WG and see what happens.
>>>
>>> Gregg Hill
>>
>> If you have an NFR copy it sounds like you're a Sonicwall partner -
>> in which case India shouldn't be involved. I've never had an issue
>> returning a busted unit & I've always gotten North American call
>> centers. Just my $.02.
>>
>>>
>>>
>>> "Lanwench [MVP - Exchange]"
>>> <lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in
>>> message news:ebtWdKurIHA.3680@TK2MSFTNGP05.phx.gbl...
>>>> Gregg Hill <greggmhill at please do not spam me at yahoo dot com>
>>>> wrote:
>>>>> Thank you!
>>>>
>>>> No prob.
>>>>
>>>>> It will be awhile before I place the WG in front of my mail
>>>>> server, as I am just getting started learning it. I gave up on
>>>>> SonicWALL after my TZ 170 failed in 14 months, then my TZ 180
>>>>> failed after about eight months.
>>>>>
>>>>> Gregg Hill
>>>>>
>>>> Were they under warranty/support? Always keep that current. I'm a
>>>> major SonicWALL fan and have once in a while run into a bum unit,
>>>> but it's rare, and they'll do a next day advance replacement.
>>>>
>>>> I've worked with Watchguards before and find the interface very
>>>> unintuitive, but I know others who swear by them. I mainly swear AT
>>>> them.
>>>>>
>>>>>
>>>>> "Lanwench [MVP - Exchange]"
>>>>> <lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote
>>>>> in message news:u5WhvYtrIHA.3940@TK2MSFTNGP03.phx.gbl...
>>>>>> Gregg Hill <greggmhill at please do not spam me at yahoo dot com>
>>>>>> wrote:
>>>>>>> Leythos,
>>>>>>>
>>>>>>> Does the WG SpamBlocker do anything to the message headers of
>>>>>>> mail it lets through to the server? Specifically, does it
>>>>>>> change any of the IP addresses listed in the headers?
>>>>>>
>>>>>> I'm not Leythos, but I play him on TV.
>>>>>>
>>>>>> If you're using ORF, just make sure you've added the IP of the WG
>>>>>> (or any upstream filter) to the intermediate hosts list to be on
>>>>>> the safe side.
>>>>>>>
>>>>>>> A response in the ORF newsgroup stated:
>>>>>>>
>>>>>>> ***************************
>>>>>>> Not the WatchGuard in particular, but I have used
>>>>>>> plenty of multi-proxy setups w/IIS SMTP, and the variables are
>>>>>>> essentially the same.
>>>>>>>
>>>>>>> In rare, high-end implementations, an inline inspecting
>>>>>>> proxy is totally transparent and its IP address is not
>>>>>>> presented to the
>>>>>>> source. However, in most cases, the SMTP proxy will
>>>>>>> terminate the incoming connection on its outside interface
>>>>>>> and create a new connection to your internal mail host. The
>>>>>>> source of that new connection will be the proxy's IP... so,
>>>>>>> yes, you do want to exclude that IP from filtering. The WG is
>>>>>>> capable of dynamically
>>>>>>> adding headers for messages that
>>>>>>> fail its CommTouch content inspection, and you can then
>>>>>>> look for those headers on the ORF level.
>>>>>>>
>>>>>>> But the questions don't stop there. Not to scare you, but
>>>>>>> some lame proxies can create a worst-of-both-worlds scenarios.
>>>>>>> Just because you exclude the zero-hop IP doesn't mean that
>>>>>>> the proxy has included the one-hop IP (the original remote IP
>>>>>>> that connected to the proxy) in a new Received: header. You may be
>>>>>>> left, at the ORF level, with no IP to look up in DNSBLs and
>>>>>>> so on.
>>>>>>> In such cases, you end up having to either abandon certain ORF
>>>>>>> tests or move them to an equivalent test performed by the
>>>>>>> proxy itself. Unfortunately, in my glance at the WG docs, they
>>>>>>> don't seem to support DNSBL lookups. Ultimately, you'll have to
>>>>>>> experiment to see what your proxy lets
>>>>>>> ORF see, and what is now hidden from ORF but can be handled by
>>>>>>> the WG. ***************************
>>>>>>>
>>>>>>> I am brand new to WG and I just want to be certain I don't do
>>>>>>> more harm than good.
>>>>>>>
>>>>>>> Thank you again for the information...and your patience with me.
>>>>>>>
>>>>>>> Gregg Hill
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> "Leythos" <void@nowhere.lan> wrote in message
>>>>>>> news:MPG.2288e7337f93b88b9897ad@adfree.usenet.com...
>>>>>>>> In article <edvYgnnrIHA.4492@TK2MSFTNGP02.phx.gbl>, "Gregg
>>>>>>>> Hill" <greggmhill at please do not spam me at yahoo dot com>
>>>>>>>> says...
>>>>>>>>> Hello!
>>>>>>>>>
>>>>>>>>> I posted this message on the Vamsoft ORF newsgroup as well as
>>>>>>>>> here, since several people have mentioned being ORF users.
>>>>>>>>>
>>>>>>>>> I just bought a WatchGuard X Core e-series X550e firewall
>>>>>>>>> http://www.watchguard.com/products/compare_results.asp?p1=x550e
>>>>>>>>> that has spam-filtering capability
>>>>>>>>> http://www.watchguard.com/products/spamblocker.asp
>>>>>>>>> and I want to know if it will interfere with ORF or not.
>>>>>>>>>
>>>>>>>>> Has anyone out there used ORF in conjunction with a firewall
>>>>>>>>> that filters spam, preferably a WatchGuard unit?
>>>>>>>>>
>>>>>>>>> Would it be considered an intermediate host?
>>>>>>>>
>>>>>>>> WG works BEFORE it reaches your server, ORF works after it
>>>>>>>> reaches your server. The two don't know each other exist. It
>>>>>>>> should work just fine. --
>>>>>>>> - Igitur qui desiderat pacem, praeparet bellum.
>>>>>>>> - Calling an illegal alien an "undocumented worker" is like
>>>>>>>> calling a drug dealer an "unlicensed pharmacist"
>>>>>>>> spam999free@rrohio.com (remove 999 for proper email address)

Gregg
Tue May 06 11:57:50 PDT 2008

"Lanwench [MVP - Exchange]"
<lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in message
news:OJ$Qe54rIHA.4544@TK2MSFTNGP04.phx.gbl...
> Gregg Hill <greggmhill at please do not spam me at yahoo dot com> wrote:
>> Yes, I am a partner, but India is what I got when I called support
>> and told them I was a partner.
>
> I'm not sure how you got there, but if you're calling from the US, phone
> (888) 777-1476. Of course, the device needs to be registered under your
> own Sonicwall account. Perhaps that's your issue.
>>


Thank you for the phone number.



>> Oh, well, that one is a moo point now.
>
> So, litigious bovines go to moo court ? ;-)
>
>
I was hoping someone would pick up on the "moo point" so I could use the
line from "Friends" when Joey said it. "Hey, who cares what cows think
anyway!" I have used that term in conversation ever since I saw it on
"Friends" and very few people say anything about it. Some get a strange look
and I think they'll bite, but they usually don't. I love the rolling of the
eyes when they do bite and they get that answer!

Yes, I do have an odd sense of humor. Most of my friends know to just keep
quiet when I pull out an odd one, since they know that there is a method to
my madness, and they suspect a setup...which it usually ends up being.

Gregg Hill



>>
>> Gregg Hill
>
>
>>
>>
>>
>> "Lanwench [MVP - Exchange]"
>> <lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in
>> message news:%23sDkRvurIHA.4544@TK2MSFTNGP04.phx.gbl...
>>> Gregg Hill <greggmhill at please do not spam me at yahoo dot com>
>>> wrote:
>>>> The TZ 170 was an NFR out of warranty and literally fried., so I got
>>>> the TZ 180 NFR, and it died while in warranty, so I got an RMA.
>>>> Convincing their Indian tech support that the TZ 180 unit had a
>>>> problem took almost two weeks...not impressive.
>>>>
>>>> Anyway, I'll try WG and see what happens.
>>>>
>>>> Gregg Hill
>>>
>>> If you have an NFR copy it sounds like you're a Sonicwall partner -
>>> in which case India shouldn't be involved. I've never had an issue
>>> returning a busted unit & I've always gotten North American call
>>> centers. Just my $.02.
>>>
>>>>
>>>>
>>>> "Lanwench [MVP - Exchange]"
>>>> <lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in
>>>> message news:ebtWdKurIHA.3680@TK2MSFTNGP05.phx.gbl...
>>>>> Gregg Hill <greggmhill at please do not spam me at yahoo dot com>
>>>>> wrote:
>>>>>> Thank you!
>>>>>
>>>>> No prob.
>>>>>
>>>>>> It will be awhile before I place the WG in front of my mail
>>>>>> server, as I am just getting started learning it. I gave up on
>>>>>> SonicWALL after my TZ 170 failed in 14 months, then my TZ 180
>>>>>> failed after about eight months.
>>>>>>
>>>>>> Gregg Hill
>>>>>>
>>>>> Were they under warranty/support? Always keep that current. I'm a
>>>>> major SonicWALL fan and have once in a while run into a bum unit,
>>>>> but it's rare, and they'll do a next day advance replacement.
>>>>>
>>>>> I've worked with Watchguards before and find the interface very
>>>>> unintuitive, but I know others who swear by them. I mainly swear AT
>>>>> them.
>>>>>>
>>>>>>
>>>>>> "Lanwench [MVP - Exchange]"
>>>>>> <lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote
>>>>>> in message news:u5WhvYtrIHA.3940@TK2MSFTNGP03.phx.gbl...
>>>>>>> Gregg Hill <greggmhill at please do not spam me at yahoo dot com>
>>>>>>> wrote:
>>>>>>>> Leythos,
>>>>>>>>
>>>>>>>> Does the WG SpamBlocker do anything to the message headers of
>>>>>>>> mail it lets through to the server? Specifically, does it
>>>>>>>> change any of the IP addresses listed in the headers?
>>>>>>>
>>>>>>> I'm not Leythos, but I play him on TV.
>>>>>>>
>>>>>>> If you're using ORF, just make sure you've added the IP of the WG
>>>>>>> (or any upstream filter) to the intermediate hosts list to be on
>>>>>>> the safe side.
>>>>>>>>
>>>>>>>> A response in the ORF newsgroup stated:
>>>>>>>>
>>>>>>>> ***************************
>>>>>>>> Not the WatchGuard in particular, but I have used
>>>>>>>> plenty of multi-proxy setups w/IIS SMTP, and the variables are
>>>>>>>> essentially the same.
>>>>>>>>
>>>>>>>> In rare, high-end implementations, an inline inspecting
>>>>>>>> proxy is totally transparent and its IP address is not
>>>>>>>> presented to the
>>>>>>>> source. However, in most cases, the SMTP proxy will
>>>>>>>> terminate the incoming connection on its outside interface
>>>>>>>> and create a new connection to your internal mail host. The
>>>>>>>> source of that new connection will be the proxy's IP... so,
>>>>>>>> yes, you do want to exclude that IP from filtering. The WG is
>>>>>>>> capable of dynamically
>>>>>>>> adding headers for messages that
>>>>>>>> fail its CommTouch content inspection, and you can then
>>&