Exchange 2007 OWA not working externally, mail issues as well

Posted on 2007-10-18
Last Modified: 2008-01-09
Yesterday I replaced a firewall in our office with a PIX515. I have set up NAT and the ACL's to allow 443, 110, 25, and 80 thru to our mail server (Exchange 2007 single server). Internally, https://myaiasrv04/owa works just fine. From outside works fine (at least enough to tell me I need to use https) so when I use https it stalls out and will not work.
Related to the Exchange issues, I cannot send out any new messages either.

Can someone get me in the right direction!! HELP!

    Author Comment

    I can connect to the port 443 via telnet:

    iwalmsley@virtue:~$ telnet 443
    Connected to
    Escape character is '^]'.
    LVL 22

    Expert Comment

    when i telnet to the ip address of on port 25( telnet 25), i do not get the reponse i would expect to get from an exchange server. something else is intercepting your traffic. i would look at your pix config, looks like something is just not right.


    Author Comment

    I got OWA to work externally. It was an SSL certificate issue. I replaced the certificate and it works.

    I am still having issue sending mail. This started today after the new firewall was installed. Getting "Delivery Delayed"  --  "This message has not yet been delivered. Microsoft Exchange will continue to try delivering the message on your behalf."

    I can receive emails no problem.
    LVL 104

    Accepted Solution

    Turn off fixup SMTP in the PIX. It will be getting in the way and stopping common antispam checks from working correctly.


    If your question has been answered, please remember to accept the answer and close the question.

    Author Comment


    Where abouts can I find that in the ASDM?

    LVL 79

    Expert Comment

    Disable smtp fixup as simon suggested:
      no fixup protocol smtp 25

    Also, make sure that your outbound IP address matches your MX record. If you only port-forward smtp/25 to the Exchange host for inbound, there is a chance that outbound email may be taking the global IP address and does not match the MX.
    Also, you may need to adjust the max dns fixup

     fixup protocol dns maximum-length 1024

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Too many email signature changes to deal with?

    Are you constantly being asked to update your organization's email signatures? Do they take up too much of your time? Wouldn't you love to be able to manage all signatures from one central location, easily design them and deploy them quickly to users. Well, you can!

    You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
    Check out this infographic on what you need to make a good email signature that will work perfectly for your organization.
    In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…
    To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    12 Experts available now in Live!

    Get 1:1 Help Now