Event ID 17220??

[MIScoord]

Not sure if this should be on the Windows 2000 board or here. We're getting the following error message a lot in the application log of our firewall server that's running W2K and ISA:

Event Type: Error
Event Source: SmtpEvt
Event Category: None
Event ID: 17220
Date: 6/20/2002
Time: 12:42:31 PM
User: N/A
Computer: XXXXX
Description:
An unknown SMTP command
Data:
0000: 58 2d 4c 49 4e 4b 32 53 X-LINK2S
0008: 54 41 54 45 20 44 52 4f TATE DRO
0010: 50 P

I know this has something to do with a some sort of command in an e-mail, but the only thing about this event on the Microsoft Knowledge Base doesn't make any sense. Anyone know what this is? Me: We need a better backup system.
My boss's boss: Backup? We don't need no stinkin' backup!

 

[Sithl0rd]

According to the microsoft web site. It means that someone sent an invalid SMTP command which was filtered by ISA at the ISA SMTP Filter and the command was not one of the allowed commands in the SMTP Filter. To get rid of these errors disable the SMTP Filter.

 

[MIScoord]

That's not really an option. Out firewall is set up to disallow traffic on any TCP port except the ones we specify. If I disable the SMTP filter, then we won't be able to receive traffic on that port and no one will get outside e-mail.

I probably wasn't specific enough above. I saw the article you are referring to on the KB website. However, we have no SMTP commands specified as being valid or invalid in the SMTP filter. I didn't even know you could do that at the filter level on ISA. I thought all the filer did was turn on or off traffic on a specific port under specific conditions (inbound or outbound, IP addresses, particular computers, etc.). That's why what the KB article was saying didn't make any sense to me.
Me: We need a better backup system.
My boss's boss: Backup? We don't need no stinkin' backup!