LDAP Acceptance Query

antony.gallez.abnetwork_ironport · ‎03-23-2008

Hello everybody,

I would like to know if it's possible to enable a "LDAP Acceptance query" only for one domain protected by Ironport?

I explain myself:
Our Ironport is used by 3 companies. One company has an exchange server and so LDAP is possible - and it works well. But (badly but) the others has another product as mail server which does not support LDAP query.

So I would like to enable LDAP acceptance query for the first company and nothing fir the 2 others.

Last, I would like to enable LDAP authentication for Spam Quarantine if possible.

Regards,
GALLEZ Antony

antony.gallez.abnetwork_ironport · ‎03-23-2008

I've found... I haven't seen the option "Bypass LDAP Accept Queries for this Recipient".

Forget me post.

staylor_ironport · ‎03-25-2008

Hi there, Bypass LDAP Accept is the easiest way, but a way to give you more control would be to create a seperate MX record for each company.
On the IronPort have an individual listener for each company, that way you can have multiple routing, accept and group queries for each company.

But as you have already found the Bypass LDAP in the RAT is the easiest option :lol:

antony.gallez.abnetwork_ironport · ‎03-25-2008

Hi there, Bypass LDAP Accept is the easiest way, but a way to give you more control would be to create a seperate MX record for each company.
On the IronPort have an individual listener for each company, that way you can have multiple routing, accept and group queries for each company.

But as you have already found the Bypass LDAP in the RAT is the easiest option  :lol:

Different MX Records means that we need different public IP adresses and we only have one. So, I'll use the "Bypass LDAP Accept" option.

BTW, thanks for your response, I haven't thought at different MX Record...

shannon.hagan · ‎03-26-2008

Starting with 5.5, they have domain based queries. I believe if you tell it to accept all the domains and then only set up domain based ldap acceptance queries for the domains that have ldap then it will work the way you want.

staylor_ironport · ‎03-26-2008

Think what you are referring to is called "Domain Assignment" it's a way of having multiple LDAP servers that hold different data, and through Domain Assignments you can specify which LDAP server to use based on the rcpt-to domain. The issue you have is that if there are no records on the LDAP for that rcpt that will be classed as a negative result and therefore be bounced.

In the case of having multiple domains and only having LDAP for one specific domain then you do need to use either the RAT "Bypass LDAP" or multiple MX records and configure on the listeners.