?
Solved

Attachments from OUTSIDE email, take hours to deliver

Posted on 2008-06-18
14
Medium Priority
?
345 Views
Last Modified: 2013-11-30
We have a FE and BE exchange server, the FE is on a DMZ, BE is on local LAN. What is happening is emails with attachments take hours to deliver?
If i go into exchange system manager and look at queue under FE, it shows the link with BE is in the "retry" state and if i go into there and look at waiting emails they all have attachments. I can "force" connection, still no good. It comes back with "the connection was dropped by remote host"???

If i let it wait, it will eventually; about 4-6 hrs, deliver the email locally??

What can i check ???
0
Comment
Question by:foad
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 5
  • 2
14 Comments
 
LVL 17

Expert Comment

by:Andres Perales
ID: 21816204
Do you have some sort of antivirus installed on those exchange servers?  if so check to see if those systems are the root cause of the problem...that is where I would start.
0
 
LVL 3

Author Comment

by:foad
ID: 21816442
Yes, symantec for exchange on FE and symantec for server on BE. I don't see anything wrong with their setup????
0
 
LVL 17

Expert Comment

by:Andres Perales
ID: 21816584
are you running the antivirus client on those servers?  If so uninstall...also to test, disable the symantec for exchange on your exchange servers to see if that makes a difference.
0
Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 25

Expert Comment

by:kieran_b
ID: 21818478
Another outstanding reason why Exchange FEs don't go in the DMZ
0
 
LVL 3

Author Comment

by:foad
ID: 21883861
well some of us HAVE to do it that way for PCI standards. Ok i have tested everything, still emails with attachments (1) meg or larger take hours to get delivered?
0
 
LVL 25

Expert Comment

by:kieran_b
ID: 21887965
>>well some of us HAVE to do it that way for PCI standards.

I am aware of no standards which force you to weaken security to qualify.

Have you uninstalled the Symantec software yet?
0
 
LVL 3

Author Comment

by:foad
ID: 21910272
yes, still any email with an attachment over 200k, stays in "queue" directory until about (8) hrs later. I'm at a loss here, nothing seems to make them go through.

All i can say is that we never had this issue before we split exchnage from "basic"; behind firewall to FE/BE.
0
 
LVL 25

Expert Comment

by:kieran_b
ID: 21910279
What more can I say - remove the FE from the DMZ and replace it with ISA - Exchange servers in the DMZ weaken security, and are a bad, bad idea
0
 
LVL 3

Author Comment

by:foad
ID: 21910349
LOL, wish i could, but we have to use DMZ. Where can i find the correct setup for "FE/BE" as far as virtual smtp, and all as i've read numerous cases that say:

The number one reason for mail delivery failure in these circumstances is a smart host on the SMTP Virtual Server on the original server.

ESM, Servers, <your server>, Protocols, SMTP. Right click on the Default SMTP VS and choose Properties. Click on the tab Delivery and then Advanced. Ensure that smart host is blank.

If you need to use a smart host for delivery then use an SMTP Connector instead.

And i have no clue if this is what i should do or how to do it, as the person who "split" our setup does not work here and we have not been able to contact them...

Al
0
 
LVL 25

Expert Comment

by:kieran_b
ID: 21910452
>>And i have no clue if this is what i should do or how to do it,

I doubt that is your problem - if it were, it would probably reject mail completely, not just add a delay.

Has this delay been there from the beginning of the FE/BE split?

Unfortunately, I don't really know how much use I am going to be to you now - when I hit a situation like this commercially, I fix it by not using and Exchange FE, but rather an ISA FE.  The only options I can give you are call Microsoft (or if you are cunning, buy a technet subscription and use one of the free calls you get with that) - or get an Exchange consultant in (but I imagine they will tell you to pull the FE from the DMZ).

MS actually do support an FE in the DMZ, but I know of no other Exchange MVPs that recommend it - still, it means that MS support (if you call them) *should* be able to get it working and fix it.
0
 
LVL 3

Author Comment

by:foad
ID: 21910477
Thanks for the quick response, i'll be calling Microsoft to open a ticket...

I'll update this question as i go...

Al
0
 
LVL 25

Expert Comment

by:kieran_b
ID: 21910483
Excellent - let us know how you get on.
0
 
LVL 3

Author Comment

by:foad
ID: 21918555
OK,  while i;m waiting for ticket, I've been doing some more digging, and this is what i've found on the BE server in the IIS logs:

17:05:51 FEmailserver      EHLO - 250
17:05:51 FEmailserver      x-exps - 0
17:05:51 FEmailserver      x-link2state - 200
17:05:51 FEmailserver      MAIL - 250
17:05:51 FEmailserver      RCPT - 250
17:05:51 FEmailserver      xexch50 - 354
17:05:51 FEmailserver      BDAT - 250
17:05:51 FEmailserver      MAIL - 250
17:05:51 FEmailserver      RCPT - 250
17:05:51 FEmailserver      xexch50 - 354
17:05:51 FEmailserver      BDAT - 250
17:05:51 FEmailserver      MAIL - 250
17:05:51 FEmailserver      RCPT - 250
17:05:51 FEmailserver      xexch50 - 354


is this normal?
and what does it all mean?
0
 
LVL 3

Accepted Solution

by:
foad earned 0 total points
ID: 22024432
Ok, after working with microsoft fro over (6) hrs on the phone, we had no answer, everything was set up correctly.

So this is what I found:
- Antivirus was not the cause
- Exchange setup was not the cause
- NIC was not the cause
- Being on the DMZ; FE, was not the cause

Came down to our firewall has reached it's max capacity and email is a hog, so by having attachments, it was overloading the firewall causing it to "queue" attachments until connectivity was low; usually after normal business hours.

So we have started the process of replacing firewall, which he palnned for new year, but must push that up. I'd like to thank everyone that tried to direct me on this and i'll be going through and looking at "responses" and try to slpit points for your efforts.

Al
0

Featured Post

 [eBook] Windows Nano Server

Download this FREE eBook and learn all you need to get started with Windows Nano Server, including deployment options, remote management
and troubleshooting tips and tricks

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A couple of months ago we ran into an issue that necessitated re-creating our Edge Subscriptions. However, when we attempted to execute the command: New-EdgeSubscription -filename C:\NewEdgeSub_01.xml we received an error indicating that the LDAP se…
As much as Microsoft wants to kill off PST file support, just as they tried to do with public folders, there are still times when it is useful or downright necessary to export Exchange mailboxes to PST files. Thankfully, it is still possible to e…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…
Suggested Courses

650 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question