Outbound E-mail from Exchange 2010 Hub Server

We have an issue where our firewall is blocking a message being sent from one of our Exchange Hub servers to a blacklisted IP address, from the inside IP of our exchange server on port 57638 to the outside IP port 25.  My concern is that the internal Hub server should not be sending any e-mail to an outside IP, since it should be routed through the Edge server and then sent from there.  How can I investigate this on the Exchange/Server side and see why this is happening?
LVL 1
fireguy1125Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

piattndCommented:
Look at your SMTP Connector for internet email.  Do you allow the hub server the ability to send over that connector?
0
piattndCommented:
Also see this article on how to achieve what you're seeing, then check to see if you have it setup that way.  If you don't want it to send directly, this should give you an idea of what settings need to be changed/removed:

http://technet.microsoft.com/en-us/library/bb738138(v=exchg.141).aspx
0
fireguy1125Author Commented:
I have the following send connectors enabled on my Hub Transport:

EdgeSync smtp to address space -- Cost 100, routing mail through smart, associated with both edge servers
Outbound email to address space * Cost 1, associated with both hub servers


How can I find out which message is being sent out from the queue viewer to this IP?  Since the traffic is being blocked by the firewall, will this cause it to be in a retry state? Would it even appear in the queue viewer? Are there any other logs I can check or enable checking, the traffic seems to occur in 5 minute intervals.
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

piattndCommented:
If the server is able to determine the next hop address, but unable to connect to the next hop, it will go into the retry queue.  If the server is unable to find the next hop, it should error.

As for your outbound email with the address space of *, that's an indication of an internet bound message (* indicates all possible destination domains).  Is there a smarthost configured on that connector?  If there is, that means the smarthost should be receiving the messages to then relay over that connector.  If no smarthost is configured, then the associated hub transport servers would send over that connector.

Check message tracking within Exchange.  It should show you the path of the message and what server sent it.  If you're not sure of a particular message that took this route, send a test message from a mailbox attached to that hub server and use that as your tracking message.
0
fireguy1125Author Commented:
No smarthost configured on the outbound email with address space *.

My Edgesync connector has a smart host configured as -- and is associated with both edge servers.  I believe that is going through our load balancers, although i'm not certain.

I was able to find the message by going through my message queue and ran a mxlookup at all the retry messages and found the ip culprit.

The retry message was: 451 4.4.0 Primary target IP address responded with: ""421 4.2.1 Unable to connect."" Attempted failover to alternate host, but that did not succeed. Either there are no alternate hosts, or delivery failed to all alternate hosts

I believe this is because our firewall was blocking the traffic, but I am concerned about the settings, i would imagine that with the edgesync configuration it would know to route mail through the edge servers for outbound mail.
0
piattndCommented:
The servers will prefer to use the connector with the lowest cost, so they are behaving exactly how you've got it configured to.  If you want to change this behavior, you need to change your configuration to either designate a smarthost on the * address space connector (that's what I would do) or reverse the costs.

Another possible solution is just to remove the association of the * address space connector from the hub transport servers and associate it with your edge servers.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
piattndCommented:
I also want to mention that I'm not sure what the address space designator of "--" will do for you.  Every setup I've ever seen has always used * as the address space when designating an internet connector.
0
fireguy1125Author Commented:
Thanks for helping me understand
0
piattndCommented:
NP, thanks for the grade and good luck!  Holler at us if you have any other questions.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.