Performa Anti-Spam Update nicht moeglich mit ISA Server und NTLM + Basic authentication

The anti-spam module doesn’t update if there is an ISA server with NTLM + Basic authentication

Symptoms

• The Anti-spam module cannot be updated if there is an ISA server 2000 with NTLM authentication on the network. When Cloudmark authenticates with a Proxy of these characteristics, it first attempts to update without using authentication. Then it retries it using Basic authentication.The ISA Server 2000 proxy servers close the connection after the first attempt, and then it unsuccessfully retries using the same method over and over again.

Version

• Panda GateDefender Performa 8200 series (Portwell); Panda GateDefender Performa 8100 series (Supermicro)

Sollten Sie dieses Problem innerhalb Ihrer Topology reproduzieren koennen so kontaktieren Sie uns bitte. Wir werden Ihnen kurzfristig einen Hotfix zu verfuegung stellen.

Gatedefender Cloudmark Updateverhalten

Gatedefender ab der Version 3 enthalten die bekannte Cloudmark Engine zur Spamerkennung. Die Spamerkennungssignatur wird Gatedefenderintern zusaetzlich ueber die von Cloudmark bereitgestellten Micro-Update Fingerprints aktuell gehalten. Hierzu wird eine TCP Verbindung zum Host microupdates.cloudmark.com hergestellt. Der Gatedefender versucht diese Kontaktaufnahme HTTP basierend zuerst auf dem Standartport fuer HTTP (80). Schlaegt dieser Versuch fehl so wird eine Kontaktaufnahme HTTP basierend auf dem SMTP Port (25) initiert.

!!! Es handelt sich NICHT um einen Versuch eine eMail zu versenden !!!

Cloudmark Micro-Updates

Micro-updates is the mechanism that allows the Cloudmark Cartridge to regularly download the latest fingerprint data used to identify abusive messages. The fingerprint data is provided by highly trusted reporters and analysis by the Trust Evaluation System in the Cloudmark Collaborative Security Network in near real-time. Therefore, proper use of the micro-update mechanism is critical in maintaining cartridge accuracy as new types of spam, phishing, and virus messages are reported.

Network interaction

Micro-updates are downloaded using standard HTTP requests. If an HTTP proxy is not enabled, then at the specified interval, a download will be attempted over port 80. If the filtering server is unable to connect to the Cloudmark micro- updates service on port 80, it will attempt to download on port 25. If this also fails, the most recent offline version of the data file in the micro_updates directory will be used until the next micro-updates interval before attempting to download again.

[tags]gatedefender,gd3.0,cloudmark[/tags]