Within about 24 hours after a reboot of my edge server, mail stops flowing from the edge server to the mailbox server.
I have one edge server and one mailbox server. The mailbox is Exchange 2016 on Server 2012 R2 and the edge is Exchange 2016 on Server 2016. The edge server is in a public-IP-addressed DMZ. This edge server is a new deployment. The old edge server was was on the same subnet as the mailbox server and did not have this problem.
This has been going on for a week. I restore mail flow by rebooting the edge server with its windows firewall turned off. Then mail flows to the mailbox server for about a day. When I reboot the edge server with the windows firewall still up, mail does not start flowing. I turn the windows firewall back on immediately after rebooting.
The Application event log on the edge server shows events 1022, 12025, and 8019 after reboot regardless whether the firewall was up or down.
Nslookup on edge shows that it obtains DNS for the Active Directory DNS server and for the mailbox server.
Telnet port 25 from edge to mailbox, and mailbox to edge, is successful.
A port query tool on the mailbox server indicates port 50636 on edge is listening.
Test-EdgeSynchronization is always "Normal".
The edge firewall has an inbound rule allowing traffic on all ports from the mailbox server.
I believe this all shows that DNS and edge synchronization are working correctly.
As time goes by, after a reboot of edge, the connections indicated in Event ID 8019 will start incrementing. Right after the reboot Event ID 8019 shows the following:
"Creating extra connection for idle queue: 3 with queue type: SmartHostConnectorDelivery
and next hop domain: mailbox.blah.blah. Current number of connections is: 1"
As time goes by the "number of connections is:" will increment up to 19 and then will go no higher. I don't know yet whether mail stops flowing when the connections start incrementing or when they reach 19.
I figure this has to be a edge firewall issue, but I have been unable to nail it down. The above confirms that the ports indicated as necessary at the following link are available. Thanks.