ISA Server Email Server Publishing

[Norphy]

What I am I missing?

I've set up ISA server 2004 on a Windows 2003 server. It is set up reasonably well, I've got it set up to accept VPN connections and to act as a caching proxy with no problem.

However I can not get it to forward emails onto our Exchange server. I've run the server publishing wizard, enable SMTP server to server communication, done everything the documentation says I should do but still it refuses it.

The ISA server is logging the connection attempts that are made but the wretched thing just notes "Failed Connection Attempt" in its logs and refuses the connection.

Can anyone make any suggestions as what I could do?

Cheers,

Norphy

[DMcCoy]

Does your email server have the isa server set as its gateway?

[Norphy]

Yep

Outgoing email from the exchange server works fine. Incoming doesn't. I should have mentioned that, sorry.

[DMcCoy]

have you created a rule to allow outgoing mail?

[petectid]

Is your Mail server configured as an ISA server Client?

[DMcCoy]

You don't need to install the client software if you use the isa server as the gateway.

[Norphy]

The mail server is configured as an ISA client, yes. There is a policy to allow outgoing mail but as I say, outgoing mail works. Incoming doesn't.

[DMcCoy]

Oh, I misread that as the other way around :P

Can you telnet in to the ip on port 25. telnet 10.0.0.1 25 for example, if you fail to connect then it is still blocked on isa or not forwarding to the correct machine. I assume you smtp feed is inbound to the ip of the isa server?

[petectid]

Do the IP addresses need to be on different subnets, ie external and internal? If so do they use the same port 25?

[Norphy]

No, I've tried that but it doesn't work.

The SMTP feed does go to the ISA server, yes. I'm sure I've opened the appropriate port and I know that its forwarding to the right server. However the interface to this software is so different to ISA 2000 I'm not certain on the first point.

[spc-rocket]

Hi,

Uninstall the firewall client from the exchange server, it doesn't need to have and and its generall not good idea to have it on servers - they should be configured as Secure NAT clients.

The internal and external IP ranges needs to be different, if your isa server has only one network card then you cannot use the server publishing rules.

I agree with DMcCoy about telnet into from an external client to see if it can reach the exchange server via isa server.

HTH,

Ashok.

[DMcCoy]

I would look at my publishing rules but I recently removed them after routing the data through a linux firewall instead. Have you tried restarting the isa server since applying the rules. I would try removing the isa client too.

[petectid]

You can still use the Firewall Client but you will also need wspcfg.ini files placed in the appropriate directories on the Mail server. But as Ashok suggests the mail server should now be a Secure Nat client, as you no longer will need to mess about with ini files.