?
Solved

Connecting Remote Servers in the same Exchange Forest

Posted on 2006-03-29
13
Medium Priority
?
559 Views
Last Modified: 2010-05-01
I currently have 3 Exchange Servers in my organization.  There is one main server (the first exchange server in the forest) here at our headquarters.  I then have 2 remote servers at different locations.  We use pix firewalls for security.  The way we have our firewalls configured - each of the remote servers can contact our headquarters server but they cannot contact each other.  Our server at our headquarters can contact both servers.  Since the 2 remote servers cannot contact each other directly, they are unable to send mail to each other.  

What I would like to do is configure our main server at our headquarters to act as a bridgehead server to our remote locations.  I tried this by creating 3 seperate routing groups each with one server.  However I was unable to succesfully configure the 2 remote locations to talk to each other.  I used the routing group connector and tried to link the 2 sites.  However, when I select the routing group that one of the remote hosts is on - it only allows me to select that remote server as a remote bridgehead - not the server at our headquarters.  Since the two remote servers do not have access to each other this does not work.  Please explain to me how to connect everything.  Do I just need to use the SMTP connector instead?
0
Comment
Question by:perinmike
13 Comments
 
LVL 24

Expert Comment

by:flyguybob
ID: 16326700
Let's assume your 3 RGs are Site1RG, Site2RG, and HQRG.

You will have to create an RGC as follows
RGC HQRG to Site1RG
RGC HQRG to Site2RG
RGC Site1RG to HQRG
RGC Site2RG to HQRG
SMTP Connector HQRG to Internet

Since there is not RPC connectivity between sites, you will want to disable public folder referrals (the little checkbox at the bottom).

So, if Site1 needs to get a message to Site2, it will go
Site1 --> HQRG --> Site2
0
 

Author Comment

by:perinmike
ID: 16327244
OK,

This is what I had orignally minus the SMTP connector.  Two quick questions about setting up these routing groups.  When I setup these Routing Groups I setup the Remote Bridgehead as HQRG right?  Does that mean that all email from Site1RG and Site2RG flows via the RGC to HQRG or is it just email between these sites that flow via the RGC's?  Second question - Since HQRG does have connectivity to both Site1RG and Site2RG why can't it directly send email between Site1RG and Site2RG using its setup VPN connection?  Last, if I do indeed need to setup the SMTP connector to send routed email to the internet - can you let me know how to do so?  Thanks so much for the help and the quick response!
0
 

Author Comment

by:perinmike
ID: 16328872
Update - Tonight I have tried what you said but am obviously doing something wrong.  I setup the RGC's from site to site.  However when I try to email a user in Site2RG from Site1RG it never leaves Site1RG.  It shows up held in the queue "messages with an unreachable destination."  I would think if the RGC's were setup and working correctley the message should show held, if anywhere, in the HQRG queue.  Let me know what you think.  Thank you!  
0
Prepare for your VMware VCP6-DCV exam.

Josh Coen and Jason Langer have prepared the latest edition of VCP study guide. Both authors have been working in the IT field for more than a decade, and both hold VMware certifications. This 163-page guide covers all 10 of the exam blueprint sections.

 
LVL 24

Accepted Solution

by:
flyguybob earned 2000 total points
ID: 16330009
Perinmike -

The only thing I can think of is that you may have a link state problem where it was setup earlier.  That gets a little messy.  If you don't mind, download WinRoute and take a look at the bridgehead status for each site.  When you drill down in the tool, after opening one of the servers, you will want to see green arrows.  You will not want to see anything noting that the object was not found in Active Directory.
http://www.microsoft.com/downloads/details.aspx?FamilyID=C5A8AFBF-A4DA-45E0-ADEA-6D44EB6C257B&displaylang=en

Regarding Site1RG to Site2RG...it will go from (Site1RG bridgehead) to (HQRG Bridgehead) then from (HQRG Bridgehead) to (Site2RG Bridgehead).

When you create a routing group connector, it will prompt you to create it on the other side.  I usually rename them and forgot to note that I allow it to create them, but also go back and rename them.  I messed up in my nomenclature.  

So you will see:
RGC HQRG to Site1RG
  Local BH should be the HQRG server and Remote BH should be the Site1RG server
RGC HQRG to Site2RG
  Local BH should be the HQRG server and Remote BH should be the Site2RG server
RGC Site1RG to HQRG
  Local BH should be the Site1RG server and the Remote BH should be the HQRG server
RGC Site2RG to HQRG
  Local BH should be the Site2RG server and the Remote BH should be the HQRG server

This configuration will allow the systems to use the HQRG Exchange server in a hub and spoke type of model.

Each site will require an Active Directory DC and Global Catalog as well as a site with an assigned Active Directory subnet.  My assumption is that those have already been setup and configured.

I assume that you have something front-ending your Exchange system, such as an Ironport, McAfee Webshield SMTP, Trend Scanmail SMTP, or other anti-spam/anti-virus gateway as a smarthost.  You would setup the SMTP connector to only allow the HQRG server to send out (1st tab) to either the IP or DNS name of the smarthost, and then the address space would be * and the default cost is 1.
A brief article on the SMTP connector is here:
http://www.msexchange.org/tutorials/Configuring-SMTP-Connector.html
0
 
LVL 24

Expert Comment

by:flyguybob
ID: 16330011
...and, if you have an LST/LSA problem you have two choices:
1)  Shut down all Exchange servers and then boot them back up.
2)  Obtain the remonitor.exe tool from Microsoft PSS and use it to scrub the Link State Table.
0
 
LVL 11

Expert Comment

by:NetoMeter Screencasts
ID: 16339783
I have a question about your network configuration.

Do you have a Site-to-Site VPN connection between the remote sites and the central site?
If the answer is yes, is there a compelling reason not to configure a Site-to-Site VPN connection between the two remote sites or configure the central PIX as a Multipoint VPN Hub and Spoke for the remote sites.

Dean
0
 

Author Comment

by:perinmike
ID: 16342457
NetoMeter,

Thanks for the question.  Yeah, our security policies prevent remote sites from having VPN connection to each other.  That one comes from above me, so unfortunatley I can't do that.  I am going to try flyguybob's suggestions later today and will post an update.  Thanks again for the responses.
0
 

Author Comment

by:perinmike
ID: 16347129
flyguybob,

Yeah.... found a bunch of object not founds.  Probably important thing to mention now that I didn't before was there was an Exchange Domain Server setup that someone uninstalled unsuccesfully.  This has been a huge problem.  Had to use an AD tool to clean it out.  Until now, I thought that server not being deleted correctly was finally out of the way.  Have a feeling some of these errors are from that server?  I'm going to be working on this over the weekend so I will have a lot more info then.  Thanks again for the help.  
0
 
LVL 24

Expert Comment

by:flyguybob
ID: 16356189
Take a look at KB82293
http://support.microsoft.com/kb/822931

You may be able to "seize" some of those roles, such as the OAB, RUS, routing group master, etc.  You may have to rebuild the system folders.
0
 

Author Comment

by:perinmike
ID: 16357621
OK -

Got it figured out.  Thanks for the latest article flyguybob - but I had already done those steps and I would find out later this was not the problem.  What I did was restart all the servers and the no object found errors cleared up.  I then used WinRoute to find that they had the same version information.  I sent an email from one remote site to the other successfully.  However I found that the version information would change quickly but then not update on the other servers - then I couldn't send email between sites anymore.

Looked into this and found it was from the Mailguard funtion being turned on, on our pix firewalls.  According to Microsoft this needs to be turned off.  Turned it off and right away the version's updated.  Appreciate all your help!  Attached is the article from Microsoft on the Mailguard protocol needing to be off in case anyone else needs to reference it.

http://support.microsoft.com/kb/320027/
0
 
LVL 24

Expert Comment

by:flyguybob
ID: 16362990
Doh!
Good catch on the mailguard issues.  We had that between one of our sites and one of our other sites.  It does not like ESMTP, that is certain.  Link state information is Port 691 in the existing site and port 25 (SMTP message) between sites (routing groups).

Thanks,

Bob
0
 

Expert Comment

by:explorer648
ID: 26383612
cn you please expand on how to make the connector, It seems complicated can I please have it in laymens
0
 
LVL 24

Expert Comment

by:flyguybob
ID: 32427207
I don't monitor EE anymore and this post is 4 months late.  You likely figured it out or found an IT pro to assist.
http://support.microsoft.com/kb/822929
  There is no such thing as laymen's terms in IT, unfortunately, BUT there are how to guides.  It's easy to tell someone that their AC compressor grenaded internally but when you tell them about the impeller shedding a blade, and the impeller is the pump that moves the freon, people's eyes glaze over.


0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Want to know how to use Exchange Server Eseutil command? Go through this article as it gives you the know-how.
In this post, I will showcase the steps for how to create groups in Office 365. Office 365 groups allow for ease of flexibility and collaboration between staff members.
how to add IIS SMTP to handle application/Scanner relays into office 365.
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question