2
Whitelisted IP Still Gets IDS Block
Problem reported by Jay Dubb - 7/27/2021 at 12:32 PM
Submitted
We have a user who frequently changes their email password-- a good thing.  However, they'll change it in Webmail but not update Outlook or iPhone (which also uses the office Wi-Fi).  

Since Outlook and iPhone are hitting the server with bad passwords, their office's public IP gets blocked by IDS, causing other office workers (who are behind the same public IP) to get blocked.

We put the IP into the whitelist for all services, yet the bad passwords continue to trigger IDS.  Is there any way to make it so IPs that are whitelisted are exempt from IDS?
 

4 Replies

Reply to Thread
0
Kyle Kerst Replied
Employee Post
I'm sorry to hear you're having trouble with this! Ultimately the whitelisting entry should suffice, but I wonder if the protocol involved might be the culprit. Is this user synchronizing via MAPI/EAS/EWS? The reason I ask is that these protocols utilize the web interface ports and so may not be covered under the whitelisting you've added for them. I'm going to test this scenario internally as well and will let you know what I come up with guidance-wise. 
Kyle Kerst System/Network Administrator SmarterTools Inc. (877) 357-6278 www.smartertools.com
1
Kyle Kerst Replied
Employee Post
Quick update for you! I completed some testing on this here on a test server, but was not able to reproduce this behavior in my testing. In my test scenario the whitelisted IP was not blocked by the IDS after repeated failed logons. If you aren't already on our latest release I'd suggest starting there, and please don't hesitate to submit a ticket on this if you need help getting to the bottom of it. Have a good one!
Kyle Kerst System/Network Administrator SmarterTools Inc. (877) 357-6278 www.smartertools.com
0
Jay Dubb Replied
We installed the latest build last week.  Protocol affected was POP3 and SMTP, not any of the Exchange/web related ports.  

Very odd.
 
0
Kyle Kerst Replied
Employee Post
Sorry Jay, I hadn't seen your reply until now. Definitely a weird one! If you see this again please submit a ticket with us and we'll dig into this for you. Have a good one!
Kyle Kerst System/Network Administrator SmarterTools Inc. (877) 357-6278 www.smartertools.com

Reply to Thread