Exchange Sites Sync through pix

Hello,
We are attempting to connect Exchange 2003 servers behind multiple pix firewalls and having trouble getting the mailboxes on site B to sync with Site A.

Site A - contains our main Exchange server and sits behind a pix 515

Site B - is our test lab sitting behind a pix 501 configured for a VPN tunnell to Site A.

The networks communicate for most features - file transfer, AD sync, and pretty much all other network traffic except for our Exchange problem.  Our Site A Exchange server recognizes our site B exchange server for everything except mail delivery.

Does anyone know what/where I need to add static or conduit statements on either Pix?  And if so, can you give me an example?  Or is it an Exchange configuration issue?

This issue is urgent for us, and any help is appreciated.  

Thanks,
Jonathan


fulcherjlAsked:
Who is Participating?
 
SorensonCommented:
for pix 6.x

no fixup protocol smtp 25    

0
 
prashsaxCommented:
You must have created a VPN between both sides.

This will enable you to open all the IP traffic between them.

Now, since you have two sites and exchange sits on each sites.

You need to create routing connector so that your exchange starts routing mails in between them.

0
 
SorensonCommented:
If you are in the same AD domain, then you shouldn't need a routing connector.  On both pix, be sure that the smtp fixup is turned off.  This will kill exchange config and intersite messaging.
0
On-Demand: Securing Your Wi-Fi for Summer Travel

Traveling this summer?Check out our on-demand webinar to learn about the importance of Wi-Fi security and 3 easy measures you can start taking immediately to protect your private data while using public Wi-Fi. Follow us today to learn more!

 
fulcherjlAuthor Commented:
Ok, I will try that - and let you know asap.

0
 
Ron MalmsteadInformation Services ManagerCommented:
agree with Sorenson.

Please post your config, blocking out the IP's of course....that will help us to assist you  further.
0
 
fulcherjlAuthor Commented:
For the moment, I have turned off smtp 25 on both firewalls -

Currently, Mails will travel from site B - out to Site A - and out to the outside world.  Email TO Site B however still gets stuck in our Test Lab Routing group connector in Site A.  I see from Sorenson, that a routing group connector does not need to be there - the connector was initially setup by a coworker as a test.  

I will remove it and see where that gets us.

keep any suggestions coming.  I welcome the assistance and will award the points as soon as mail is successfully routed to site B.

.....more soon......
0
 
SorensonCommented:
Are both exchange servers in the same AD domain?  Remove routing group connector, then stop - start SMTP under servers - protocols in ESM.
0
 
fulcherjlAuthor Commented:
Yes, both Exchange servers are in the same AD domain.  We removed the routing group connector, stopped then restarted SMTP through ESM with no luck with our current test account.  Still - messages can be sent from site B to anywhere in site A/the world - but messages to mailboxes in Site B are getting hung in the Queue called testerv.BLANK.ORG

But at this point, the exchange servers are communicating on all ports - now i beleive we are up against an Exchange issue.  

Our Que list on our main Exchange Server looks like this regarding SMTP connections - Our issue is with mailboxes on "testserv"

SMTP Connector to Viruswall - [192.168.0.3] (SMTP Connector) SMTP Default SMTP Virtual Server Active 0
SMTP Mailbox Store (MARS)   X400 Exchange MTA Active 0
testserv.blank.org SMTP Default SMTP Virtual Server Retry 4



Thanks for the Pix tip Sorenson - the points are yours.  Any other help you can offer is greatly appreciated.


General question - at this point, should i reopen this issue in another forum?

0
 
SorensonCommented:
with regards to the messages stuck in queue.  Can you telnet between the exchange servers directly on port 25 ?

ie:  telnet x.x.x.x  25  and enter simple commands (helo, etc) between the servers?  or does the viruswall intercept and proxy the requests? Exchange servers send config info via smtp, and most firewalls / smtp proxies see this traffic as non-rfc compliant and dump it.  Unfortunately it is needed :)

If the telnets both directions are clean, then I would freeze the queue, remove all messages from it, restart the queue, and then restart the smtp (under protocols, in ESM).

0
 
fulcherjlAuthor Commented:
Telnet traffic seems fine between the two - getting "Hello" responses each way with no issue.

I took your suggestion about freezing the queue, removing messages, restarting the queue and restarting smtp on both servers via ESM to no avail unfortunately.

We will keep digging until we find an answer.  Thanks again for all of your help and suggestions in getting our telnet traffice between the two up and running.  if you have any other ideas, let me know.

Thanks,
Jonathan



0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.