Gents
Software in this set up
1 x Forefront TMG 2010
2 x Exchange CAS/HUB in NLB set up
1 x Mail Gateway 10.0.2 Virtual Edition
Just finished an implementation of a Mail Gateway Appliance, i have set up the appliance behind a Microsoft TMG 2010, Mail arrives from outside, pass thru TMG then gets filtered on the Mail Appliance then it delivers it to my Client Access Array.
All works well but then after these past 3 days i have noticed a large amount of blocked connections attemps made by the forefront to the Mail Appliance i think, this is what it is on the diagnostics:
The FULL log is attached.
Any help would be appriciated.
2013 Mar 31 01:54:32 (notice) stunnel: LOG5[19264:3086904208]: Protocol negotiations succeeded
2013 Mar 31 01:54:33 (notice) stunnel: LOG5[19264:3086904208]: Certificate accepted: depth=3, /C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
2013 Mar 31 01:54:33 (notice) stunnel: LOG5[19264:3086904208]: Certificate accepted: depth=2, /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
2013 Mar 31 01:54:33 (notice) stunnel: LOG5[19264:3086904208]: Certificate accepted: depth=1, /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 International Server CA - G3
2013 Mar 31 01:54:33 (notice) stunnel: LOG5[19264:3086904208]: Certificate accepted: depth=0, /C=US/ST=California/L=Mountain View/O=Symantec Corporation/OU=Messaging and Web Security/CN=SWUPDATE.BRIGHTMAIL.COM
2013 Mar 31 01:54:34 (notice) stunnel: LOG5[19264:3086904208]: Certificate accepted: depth=3, /C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
2013 Mar 31 01:54:34 (notice) stunnel: LOG5[19264:3086904208]: Certificate accepted: depth=2, /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
2013 Mar 31 01:54:34 (notice) stunnel: LOG5[19264:3086904208]: Certificate accepted: depth=1, /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 International Server CA - G3
2013 Mar 31 01:54:34 (notice) stunnel: LOG5[19264:3086904208]: Certificate accepted: depth=0, /C=US/ST=California/L=Mountain View/O=Symantec Corporation/OU=Messaging and Web Security/CN=SWUPDATE.BRIGHTMAIL.COM
2013 Mar 31 01:54:34 (notice) stunnel: LOG5[19264:3086904208]: Connection closed: 404 bytes sent to SSL, 498 bytes sent to socket
2013 Mar 31 01:57:35 (notice) syslog-ng[1884]: STATS: dropped 0
2013 Mar 31 02:01:28 (notice) stunnel: LOG5[19264:3086904208]: Service pseudo-https accepted connection from 127.0.0.1:54456
2013 Mar 31 02:01:28 (notice) stunnel: LOG5[19264:3086904208]: connect_blocking: connected 172.31.255.251:8080
2013 Mar 31 02:01:28 (notice) stunnel: LOG5[19264:3086904208]: Service pseudo-https connected remote server from 172.31.255.233:64091
2013 Mar 31 02:01:28 (notice) stunnel: LOG5[19264:3086904208]: Negotiations for connect (client side) started
2013 Mar 31 02:01:41 (err) stunnel: LOG3[19264:3086904208]: CONNECT request rejected
2013 Mar 31 02:01:41 (notice) stunnel: LOG5[19264:3086904208]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2013 Mar 31 02:01:41 (notice) stunnel: LOG5[19264:3086904208]: Service pseudo-https accepted connection from 127.0.0.1:54459
2013 Mar 31 02:01:41 (notice) stunnel: LOG5[19264:3086904208]: connect_blocking: connected 172.31.255.251:8080
2013 Mar 31 02:01:41 (notice) stunnel: LOG5[19264:3086904208]: Service pseudo-https connected remote server from 172.31.255.233:64094
2013 Mar 31 02:01:41 (notice) stunnel: LOG5[19264:3086904208]: Negotiations for connect (client side) started
2013 Mar 31 02:02:05 (err) stunnel: LOG3[19264:3086904208]: CONNECT request rejected
2013 Mar 31 02:02:05 (notice) stunnel: LOG5[19264:3086904208]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2013 Mar 31 02:02:05 (notice) stunnel: LOG5[19264:3086904208]: Service pseudo-https accepted connection from 127.0.0.1:54462
2013 Mar 31 02:02:05 (notice) stunnel: LOG5[19264:3086904208]: connect_blocking: connected 172.31.255.251:8080
2013 Mar 31 02:02:05 (notice) stunnel: LOG5[19264:3086904208]: Service pseudo-https connected remote server from 172.31.255.233:64097
2013 Mar 31 02:02:05 (notice) stunnel: LOG5[19264:3086904208]: Negotiations for connect (client side) started
2013 Mar 31 02:02:29 (err) stunnel: LOG3[19264:3086904208]: CONNECT request rejected
2013 Mar 31 02:02:29 (notice) stunnel: LOG5[19264:3086904208]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2013 Mar 31 02:02:29 (notice) stunnel: LOG5[19264:3086904208]: Service pseudo-https accepted connection from 127.0.0.1:54465
2013 Mar 31 02:02:29 (notice) stunnel: LOG5[19264:3086904208]: connect_blocking: connected 172.31.255.251:8080
2013 Mar 31 02:02:29 (notice) stunnel: LOG5[19264:3086904208]: Service pseudo-https connected remote server from 172.31.255.233:64100
2013 Mar 31 02:02:29 (notice) stunnel: LOG5[19264:3086904208]: Negotiations for connect (client side) started
2013 Mar 31 02:02:53 (err) stunnel: LOG3[19264:3086904208]: CONNECT request rejected
2013 Mar 31 02:02:53 (notice) stunnel: LOG5[19264:3086904208]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2013 Mar 31 02:02:53 (notice) stunnel: LOG5[19264:3086904208]: Service pseudo-https accepted connection from 127.0.0.1:54468
2013 Mar 31 02:02:53 (notice) stunnel: LOG5[19264:3086904208]: connect_blocking: connected 172.31.255.251:8080
2013 Mar 31 02:02:53 (notice) stunnel: LOG5[19264:3086904208]: Service pseudo-https connected remote server from 172.31.255.233:64103
2013 Mar 31 02:02:53 (notice) stunnel: LOG5[19264:3086904208]: Negotiations for connect (client side) started
2013 Mar 31 02:03:17 (err) stunnel: LOG3[19264:3086904208]: CONNECT request rejected
2013 Mar 31 02:03:17 (notice) stunnel: LOG5[19264:3086904208]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2013 Mar 31 02:03:17 (notice) stunnel: LOG5[19264:3086904208]: Service pseudo-https accepted connection from 127.0.0.1:54471
2013 Mar 31 02:03:17 (notice) stunnel: LOG5[19264:3086904208]: connect_blocking: connected 172.31.255.251:8080
2013 Mar 31 02:03:17 (notice) stunnel: LOG5[19264:3086904208]: Service pseudo-https connected remote server from 172.31.255.233:64106
2013 Mar 31 02:03:17 (notice) stunnel: LOG5[19264:3086904208]: Negotiations for connect (client side) started