Exchange Relay from the DMZ

Posted on 2012-09-18
Last Modified: 2012-10-17
Exchange to MobileIron in DMZ
Asked by: Tencha
There is a server in the dmz "MobileIron" and we are trying to set up a connection where "mobile iron" server can send e-mail by connecting to Exchange that is located internal.
At this point we have the firewall set up to allow mobile iron to send via port 25. The connection "kinda" works, because from mobile iron server we receive internal email when we test the connection from the application.
Layout Receive:
MobileIron Server- IN DMZ
Cisco ASA Firewall routing from DMZ to TMG server
TMG server to load balancer "Kemp"
From the Kemp  to our primary CAS Array
Layout for Send:
Exact same thing in reverse however there are not restriction or logging.

What is the set-up need to ensure that the mobile iron server within the DMZ can contact the exchange server internally?
Question by:Tencha
    LVL 12

    Expert Comment

    First, what version of Exchange are you using?
    Chances are, you just need to add the IP of the DMZ device to the network tab of the  Receive connector in the HUB.
    In 2007, it looks like this:
    General TabNetwork TabAuthentication TabPermission Group Tab

    Author Comment

    I am on Ex2010 Sp1 I did all those steps and through the various testing I remove all the security check boxes to ensure nothing would prevent the connection. Still didn't work.
    Also, I could not add the server to "exchange servers" because it in not part of the internal AD network, hence why this is no so easy.
    LVL 63

    Expert Comment

    by:Simon Butler (Sembee)
    Just follow the guide from the Exchange team for Exchange 2007:
    It is the same for Exchange 2010. The fact that it is in the DMZ makes no difference other than ensuring the NAT is correct (if used) so that you don't turn Exchange in to an open relay.


    Author Comment

    Still not working external. I am able to get e-mail routed from DMZ to internal address accounts. But from the DMZ server "Mobile Iron" I can not route e-mail out using our exchange system.
    LVL 63

    Expert Comment

    by:Simon Butler (Sembee)
    Internal addresses aren't a relay.
    Did you setup a new connector? If so, configure logging on it so that you can see what happens when you try to send email. It could be that the IP address Exchange sees is different to the one you think it is, and the wrong connector is being used.


    Accepted Solution

    The same IP address was located within another Relay and had stricter rights. Once I removed the IP from the second relay, mail was working as expected.

    Author Closing Comment

    It was not suggested....

    Featured Post

    Better Security Awareness With Threat Intelligence

    See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

    Join & Write a Comment

    Suggested Solutions

    Resolve Outlook connectivity issues after moving mailbox to new Exchange 2016 server
    Not sure what the best email signature size is? Are you worried about email signature image size? Follow this best practice guide.
    In this video we show how to create a User Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Mailb…
    To show how to create a transport rule in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Rules tab.:  To cr…

    755 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    21 Experts available now in Live!

    Get 1:1 Help Now