Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

Ironport alerts

I keep getting alerts from my Ironport equipment with the message:

The Warning message is:

The query Ironport.accept failed with result inquiry timed out

Any one experience this before?

Thanks for your anticipated feedback

Cisco Employee

Ironport alerts

The most common cause for this problem is that a connection is being dropped by your firewall or other network equipment due to their TCP idle timeout settings.

The ESA will maintain a number of active TCP sessions to your LDAP servers.  These will be used for 6 hours or 10,000 queries, whichever comes first.

What can happen is that the a TCP session can remain idle for some time while mail flow is slow.  When the ESA attempts to re-use that connection, your firewall may see that this TCP session has not been used for a long time and so it will drop the packet.

To correct this, you would need to disable the TCP idle timeout settings on your firewall for the ESA's IP address.

While this issue does produce the occasional alert message, it should not have any significant impact on mail flow.  If an LDAP query times out the appliance may soft bounce an email, but the sending server should retry any soft bounces.  This means that this may delay emails but it should not cause them to be dropped or hard bounced.

To make sure that the issue is not something more serious, I recommend going to System Administration -> LDAP, clicking on your LDAP server profile and running a test query for your "Accept" query.  If you see the expected results here, the issue is almost certainly the transient TCP idle timeout problem described above.

Hope this helps!


(*If you have received the answer to your original question, and found this helpful/correct - please mark the question as answered, and be sure to leave a rating to reflect!)

New Member

Ironport alerts

Thanks Robert,

I get a 'Pass' when I test the query. So that seems fine. It has occured frequently of recent even when I believe there's reasonable mail flow. Hard to know what else the problem could be.

New Member

Ironport alerts

Is there a way to view a list or collection of recently blocked emails from my Ironport GUI?I can't find mails that have been recently blocked.

CreatePlease login to create content