Improve company productivity with a Business Account.Sign Up

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 286
  • Last Modified:

Exchange Sites Sync through pix

We are attempting to connect Exchange 2003 servers behind multiple pix firewalls and having trouble getting the mailboxes on site B to sync with Site A.

Site A - contains our main Exchange server and sits behind a pix 515

Site B - is our test lab sitting behind a pix 501 configured for a VPN tunnell to Site A.

The networks communicate for most features - file transfer, AD sync, and pretty much all other network traffic except for our Exchange problem.  Our Site A Exchange server recognizes our site B exchange server for everything except mail delivery.

Does anyone know what/where I need to add static or conduit statements on either Pix?  And if so, can you give me an example?  Or is it an Exchange configuration issue?

This issue is urgent for us, and any help is appreciated.  


1 Solution
You must have created a VPN between both sides.

This will enable you to open all the IP traffic between them.

Now, since you have two sites and exchange sits on each sites.

You need to create routing connector so that your exchange starts routing mails in between them.

If you are in the same AD domain, then you shouldn't need a routing connector.  On both pix, be sure that the smtp fixup is turned off.  This will kill exchange config and intersite messaging.
for pix 6.x

no fixup protocol smtp 25    

The IT Degree for Career Advancement

Earn your B.S. in Network Operations and Security and become a network and IT security expert. This WGU degree program curriculum was designed with tech-savvy, self-motivated students in mind – allowing you to use your technical expertise, to address real-world business problems.

fulcherjlAuthor Commented:
Ok, I will try that - and let you know asap.

Ron MalmsteadInformation Services ManagerCommented:
agree with Sorenson.

Please post your config, blocking out the IP's of course....that will help us to assist you  further.
fulcherjlAuthor Commented:
For the moment, I have turned off smtp 25 on both firewalls -

Currently, Mails will travel from site B - out to Site A - and out to the outside world.  Email TO Site B however still gets stuck in our Test Lab Routing group connector in Site A.  I see from Sorenson, that a routing group connector does not need to be there - the connector was initially setup by a coworker as a test.  

I will remove it and see where that gets us.

keep any suggestions coming.  I welcome the assistance and will award the points as soon as mail is successfully routed to site B.

.....more soon......
Are both exchange servers in the same AD domain?  Remove routing group connector, then stop - start SMTP under servers - protocols in ESM.
fulcherjlAuthor Commented:
Yes, both Exchange servers are in the same AD domain.  We removed the routing group connector, stopped then restarted SMTP through ESM with no luck with our current test account.  Still - messages can be sent from site B to anywhere in site A/the world - but messages to mailboxes in Site B are getting hung in the Queue called testerv.BLANK.ORG

But at this point, the exchange servers are communicating on all ports - now i beleive we are up against an Exchange issue.  

Our Que list on our main Exchange Server looks like this regarding SMTP connections - Our issue is with mailboxes on "testserv"

SMTP Connector to Viruswall - [] (SMTP Connector) SMTP Default SMTP Virtual Server Active 0
SMTP Mailbox Store (MARS)   X400 Exchange MTA Active 0 SMTP Default SMTP Virtual Server Retry 4

Thanks for the Pix tip Sorenson - the points are yours.  Any other help you can offer is greatly appreciated.

General question - at this point, should i reopen this issue in another forum?

with regards to the messages stuck in queue.  Can you telnet between the exchange servers directly on port 25 ?

ie:  telnet x.x.x.x  25  and enter simple commands (helo, etc) between the servers?  or does the viruswall intercept and proxy the requests? Exchange servers send config info via smtp, and most firewalls / smtp proxies see this traffic as non-rfc compliant and dump it.  Unfortunately it is needed :)

If the telnets both directions are clean, then I would freeze the queue, remove all messages from it, restart the queue, and then restart the smtp (under protocols, in ESM).

fulcherjlAuthor Commented:
Telnet traffic seems fine between the two - getting "Hello" responses each way with no issue.

I took your suggestion about freezing the queue, removing messages, restarting the queue and restarting smtp on both servers via ESM to no avail unfortunately.

We will keep digging until we find an answer.  Thanks again for all of your help and suggestions in getting our telnet traffice between the two up and running.  if you have any other ideas, let me know.


Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

What Kind of Coding Program is Right for You?

There are many ways to learn to code these days. From coding bootcamps like Flatiron School to online courses to totally free beginner resources. The best way to learn to code depends on many factors, but the most important one is you. See what course is best for you.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now