Internal Email Routing [Exchange 2003 & Cisco ASA 5540] - Routing Group Connectors

Hi,

I have 3 exchange 2003 servers. One of the exchange server (EXSRV1) routes emails to the other two exchange servers (EXSRV2 and EXSRV3). EXSRV1 is behind a cisco asa 5540 firewall.

EXSRV1 are clustered (Active/Passive)
The 3 server communicate via Routing Group connectors.

The mails to EXSRV2 and EXSRV3 are queued up on EXSRV1 and are delivered to the other two servers hours after the time of submission. Sometimes the number of mails in the queue goes up to 250.

I have been working on this problem for 5 days now and I can't figure out why the emails are queuing up and being delivered hours after initial submission to EXSRV1.

User from the other two servers (EXSRV2 & EXSRV3) can send to EXSRV1 with no delay.

Telnet results from EXSRV1 to EXSRV2 and EXSRV3 are below:

telnet EXSRV2 25
 220 EXSRV2.domain.local Microsoft ESMTP MAIL Service, Version: 6.0.3790.3959 ready at  Thu, 12 May
 2011 15:37:37 +1200
ehlo
250-EXSRV2.domain.local Hello [10.2.0.10]
250-TURN
250-SIZE
250-ETRN
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-8bitmime
250-BINARYMIME
250-CHUNKING
250-VRFY
250-X-EXPS GSSAPI NTLM LOGIN
250-X-EXPS=LOGIN
250-AUTH GSSAPI NTLM LOGIN
250-AUTH=LOGIN
250-X-LINK2STATE
250-XEXCH50
250 OK

Telnet to EXSRV3.
telnet EXSRV3 25

220 EXSRV3 Microsoft ESMTP MAIL Service, Version: 6.0.3790.1830 ready at  Thu, 12 May
 2011 15:41:00 +1200
ehlo
250-EXSRV3 Hello [10.2.0.10]
250-TURN
250-SIZE 4194304
250-ETRN
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-8bitmime
250-BINARYMIME
250-CHUNKING
250-VRFY
250-X-EXPS GSSAPI NTLM LOGIN
250-X-EXPS=LOGIN
250-AUTH GSSAPI NTLM LOGIN
250-AUTH=LOGIN
250-X-LINK2STATE
250-XEXCH50
250 OK

itc_sysadminAsked:
Who is Participating?
 
itc_sysadminAuthor Commented:
Finally figured out why the emails were being delayed and  stuck in the routing group queue.
it was the IPS running on our Tier 1 FW in front of our cisco asa. Created a separate rule for the exchange servers and then restarted smtp. All mails are now being sent. Sent a test mail to users from remote site, they received it within 1 minute.

0
 
lrmooreCommented:
Have you disabled esmtp inspect on the ASA?
0
 
John MeggersNetwork ArchitectCommented:
First off, I know very little about Exchange, so I'm not familiar with routing group connectors.  I did Google and found that they do not use port 25, though.

When you say EXSRV1 is behind an ASA, do you mean it's on the trusted side whereas the other two servers are on the untrusted side?  If that's the case, then the ASA wouldn't seem to be the problem, but it might be worth looking at what your firewall rules are anyway.  But it doesn't seem likely the ASA would cause mail to delay and then finally let it through as if there were some kid of threshold to be met; if the connection is permitted, it's permitted, and if not, then it's blocked.  You can check the ASA logs to see if it tells you what's being blocked.  

Are you sure there's not a setting on EXSRV1 that's resulting in the delay?  If you're confident of the ASA configuration, and of the Exchange configuration, I'd be tempted to use Wireshark to capture packets to see if you can identify what's happening.
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

 
itc_sysadminAuthor Commented:
Irmoore,

The only inspect I have on the ASA firewall are:

dynamic-access-policy-record DfltAccessPolicy
policy-map type inspect dns preset_dns_map
policy-map my-ips-policy
service-policy my-ips-policy interface Outside


0
 
itc_sysadminAuthor Commented:
I ran the Exchange Troubleshooting Tool and it gave some warnings

Warning 1:

Ping (Don't fragment = 'True' and buffer size = 4096) from server EXSRV1 to remote server EXSRV2 was not successful as the packet needs to be fragmented.

Warning 2:
The Pointer (PTR) record EXSRV1 does not match any fully-qualified domain name of the SMTP instances on server EXSRVXCH01. This may cause routing problems when remote servers have a filter to map an IP address to a server name.

EXSRVXCH01 is the exchange virtual instance on the cluster.




0
 
itc_sysadminAuthor Commented:
I manage to resolve the errors from the exchange best practice analyzer. This did not help much.
Even though the queue on the routing group connectors are now less than 100, the mails are still delayed until I restart the SMTP service on the remote exchange server but this only works for a 15 minutes.

I might try and re-create the routing group connectors and see if that fixes this mail delivery issue.
0
 
itc_sysadminAuthor Commented:
Solutions given by the experts were close to accurate but they were really helpfull.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.