Jump to content

Recommended Posts

Posted

We use to have our exchange on one public external IP address. I have now moved Exchange over to use TMG.

 

I done this by creating three rules

 

1- OWA

2- ActiveSync

3- Outlook Anywhere

 

However we now have a major problem.

 

We cant receive external mail!

I can seem to send mail out, but for some reason when I look at the source of the message, its still using the old public external IP address.

 

----------------------------------------

The only DNS records externally we have is

 

* CNAME Record - remote.ockendon.thurrock.e2bn.org

www CNAME Record - remote.ockendon.thurrock.e2bn.org

 

mail.messaging.microsoft.com - MX Record

 

----------------------------------------

remote.ockendon.thurrock.e2bn.org then goes to the council DNS and then to our TMG server.

mail.messaging.microsoft.com is Forefront Online Protection, this has got both the outgoing and incoming IP address (updated to match the same IP address of the TMG server)

 

Also have got the council to delete the old NAT settings for the old external public IP address so it would not interfere.

 

Is there something I have missed?

 

Many thanks

Posted

Can mail.messaging.microsoft.com contact your exchange server on tcp 25 / smtp?

 

(I can't on your remote.ockendon.thurrock.e2bn.org but you've probably denied that intentionally so just worth checking your MX can reach your exchange)

Posted

I was poking remote.ockendon.* on port 25 and it refused it, normally for a mail server that means nothing can send mail to it.

 

Though in your case because you have a separate server in place receiving the mail first (mail.messaging.microsoft.com) and then passing it over to you, as long as the mail.messaging one can talk to your server on port 25 you should be fine.

 

I'm not an exchange guy though, so I could be wrong completely :)

Posted
I was poking remote.ockendon.* on port 25 and it refused it, normally for a mail server that means nothing can send mail to it.

 

Though in your case because you have a separate server in place receiving the mail first (mail.messaging.microsoft.com) and then passing it over to you, as long as the mail.messaging one can talk to your server on port 25 you should be fine.

 

I'm not an exchange guy though, so I could be wrong completely :)

 

Have you tried Microsoft's Exchange Connectivity Analyzer website

Posted

ah forgot about using that site :)

 

Incoming SMTP test

 

[TABLE=class: logTable tb tbFixed]

[TR]

[TD]Testing inbound SMTP mail flow for domain [email protected].

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]Inbound SMTP mail flow was verified successfully.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Test Steps

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]

[/TD]

[TD]Attempting to retrieve DNS MX records for domain theockendonacademy.com.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]One or more MX records were successfully retrieved from DNS.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Additional Details

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD=class: addtlDetailsCell]MX Records Host mail.messaging.microsoft.com, Preference 10

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

[TABLE=class: tb tbFixed]

[TR]

[TD][/TD]

[TD]Testing Mail Exchanger mail.messaging.microsoft.com.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]This Mail Exchanger was tested successfully.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Test Steps

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD][/TD]

[TD]Attempting to resolve the host name mail.messaging.microsoft.com in DNS.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]The host name resolved successfully.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Additional Details

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD=class: addtlDetailsCell]IP addresses returned: 216.32.180.22, 216.32.180.190

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

[TABLE=class: tb tbFixed]

[TR]

[TD][/TD]

[TD]Testing TCP port 25 on host mail.messaging.microsoft.com to ensure it's listening and open.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]The port was opened successfully.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Additional Details

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD=class: addtlDetailsCell]Banner received: 220 VA3EHSMHS022.bigfish.com Microsoft ESMTP MAIL Service ready at Fri, 24 Aug 2012 10:28:30 +0000

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

[TABLE=class: tb tbFixed]

[TR]

[TD][/TD]

[TD]Attempting to send a test e-mail message to [email protected] using MX mail.messaging.microsoft.com.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]The test message was delivered successfully.

[/TD]

[/TR]

[/TABLE]

[TABLE=class: tb tbFixed]

[TR]

[TD][/TD]

[TD]Testing the MX mail.messaging.microsoft.com for open relay by trying to relay to user [email protected].

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]The Open Relay test passed. This mx isn't an open relay.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Additional Details

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD=class: addtlDetailsCell]The open relay test message delivery failed, which is a good thing.

The exception detail:

Exception details:

Message: Mailbox unavailable. The server response was: 5.4.1 Relay Access Denied

Type: System.Net.Mail.SmtpFailedRecipientException

Stack trace:

at System.Net.Mail.SmtpTransport.SendMail(MailAddress sender, MailAddressCollection recipients, String deliveryNotify, SmtpFailedRecipientException& exception)

at System.Net.Mail.SmtpClient.Send(MailMessage message)

at Microsoft.Exchange.Tools.ExRca.Tests.SmtpOpenRelayTest.PerformTestReally()

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

Outcoming SMTP test

 

[TABLE=class: logTable tb tbFixed]

[TR]

[TD]SuccessWarn.png

[/TD]

[TD]Performing Outbound SMTP Test

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]The outbound SMTP test was successful.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Test Steps

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Success.png

[/TD]

[TD]Attempting reverse DNS lookup for IP address 85.12.92.88.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]ExRCA successfully resolved IP address 85.12.92.88 via reverse DNS lookup.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Additional Details

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD=class: addtlDetailsCell]ExRCA resolved IP address 85.12.92.88 to host remote.ockendon.thurrock.e2bn.org.

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

[TABLE=class: tb tbFixed]

[TR]

[TD]Success.png

[/TD]

[TD]Performing Real-Time Black Hole List (RBL) Test

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]Your IP address wasn't found on any of the block lists selected.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Test Steps

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]

[/TD]

[TD]Checking Block List "SpamHaus Block List (SBL)"

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]The address isn't on the block list.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Additional Details

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD=class: addtlDetailsCell]IP address 85.12.92.88 wasn't found on RBL.

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

[TABLE=class: tb tbFixed]

[TR]

[TD]

[/TD]

[TD]Checking Block List "SpamHaus Exploits Block List (XBL)"

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]The address isn't on the block list.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Additional Details

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD=class: addtlDetailsCell]IP address 85.12.92.88 wasn't found on RBL.

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

[TABLE=class: tb tbFixed]

[TR]

[TD]

[/TD]

[TD]Checking Block List "SpamHaus Policy Block List (PBL)"

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]The address isn't on the block list.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Additional Details

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD=class: addtlDetailsCell]IP address 85.12.92.88 wasn't found on RBL.

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

[TABLE=class: tb tbFixed]

[TR]

[TD]

[/TD]

[TD]Checking Block List "SpamCop Block List"

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]The address isn't on the block list.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Additional Details

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD=class: addtlDetailsCell]IP address 85.12.92.88 wasn't found on RBL.

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

[TABLE=class: tb tbFixed]

[TR]

[TD]

[/TD]

[TD]Checking Block List "NJABL.ORG Block List"

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]The address isn't on the block list.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Additional Details

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD=class: addtlDetailsCell]IP address 85.12.92.88 wasn't found on RBL.

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

[TABLE=class: tb tbFixed]

[TR]

[TD]

[/TD]

[TD]Checking Block List "SORBS Block List"

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]The address isn't on the block list.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Additional Details

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD=class: addtlDetailsCell]IP address 85.12.92.88 wasn't found on RBL.

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

[TABLE=class: tb tbFixed]

[TR]

[TD]

[/TD]

[TD]Checking Block List "MSRBL Combined Block List"

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]The address isn't on the block list.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Additional Details

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD=class: addtlDetailsCell]IP address 85.12.92.88 wasn't found on RBL.

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

[TABLE=class: tb tbFixed]

[TR]

[TD]

[/TD]

[TD]Checking Block List "UCEPROTECT Level 1 Block List"

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]The address isn't on the block list.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Additional Details

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD=class: addtlDetailsCell]IP address 85.12.92.88 wasn't found on RBL.

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

[TABLE=class: tb tbFixed]

[TR]

[TD]

[/TD]

[TD]Checking Block List "AHBL Block List"

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]The address isn't on the block list.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Additional Details

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD=class: addtlDetailsCell]IP address 85.12.92.88 wasn't found on RBL.

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

[TABLE=class: tb tbFixed]

[TR]

[TD]SuccessWarn.png

[/TD]

[TD]Performing Sender ID validation.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]Sender ID validation was performed successfully.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Test Steps

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Error.png

[/TD]

[TD]Attempting to find the SPF record using a DNS TEXT record query.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]ExRCA wasn't able to find the SPF record.

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD][TABLE=class: tb tbFixed]

[TR]

[TD]Minus.gif

[/TD]

[TD]Additional Details

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD=class: addtlDetailsCell]No records were found.

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

 

[/TD]

[/TR]

[/TABLE]

Any ideas?

Posted (edited)

Hi such

 

Internal mail works fine (active directory user to another active directory user in the same domain)

 

External mail we just don't receive :(

 

Now I have again just look at the Forefront Online and I decided to take a look at the reports, email is getting to Fore Front Online, no problem.

So the problem lays between either

 

 

Forefront to TMG server

 

or

 

 

TMG Server to Exchange server

 

I have noticed a error with I have corrected on the Forefront Site. Each domain you also have to change the Outbound Mail Server IP Addresses, I didn't notice this. Wouldn't have even thought you would have that there because on the main page it's got the same option.

Still not receiving after changing that.

 

 

We don't seem to be getting any NDRs :(

Edited by pritchardavid
Posted
FOPE changes can take up tp 45mins or 2 hours, if the issue is still there, then up the logging on exch server to verbose on the receive connector.
Posted

Just sent out a mail from the exchange server to my personal email, receives fine expect it finds the old external IP address!? how is that possible?

 

x-store-info:J++/JTCzmObr++wNraA4Pa4f5Xd6uensxNRGNyaWNyfixa3FbyjfZD+KOBmp4VfRT7yDSXMqZW6aOPhlz5VZqPRnFTFKbdH6t1q1QYGzAuG4qoX3qq1GRGHGANcrheNNNonJHnu5W8o=

Authentication-Results: hotmail.com; sender-id=none (sender IP is 85.12.92.85) [email protected]; dkim=none header.d=theockendonacademy.com; x-hmca=none

X-SID-PRA: [email protected]

X-DKIM-Result: None

X-SID-Result: None

X-AUTH-Result: NONE

X-Message-Status: n:n

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MTtHRD0xO1NDTD0w

X-Message-Info: aKlYzGSc+Ll01bU5z89gvAsY2S8105M4khMRlYqDzWDyu/7XDBP8opkoytE/jMb2AkoJFl1XPVDAxT22rH7Ip1P3fMlybd37H1En8ALcMsscp0ya+eV4Mnb13iL9O5SDe53mw2tFKe2cvNCDDPZ6hg==

Received: from mail.theockendonacademy.com ([85.12.92.85]) by COL0-MC1-F17.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);

Fri, 24 Aug 2012 11:05:28 -0700

Received: from EXCHANGE.theockendonacademy.com ([fe80::1c65:2d8:73a:bb8f]) by

EXCHANGE.theockendonacademy.com ([fe80::1c65:2d8:73a:bb8f%13]) with mapi id

14.02.0298.004; Fri, 24 Aug 2012 19:04:59 +0100

From: David Pritchard

To: "[email protected]"

Subject: test

Thread-Topic: test

Thread-Index: Ac2CIvlL17gA0mXhSKqhhOThslQTUQ==

Date: Fri, 24 Aug 2012 18:04:58 +0000

Message-ID: <919F91E36141E84C8E78046DD648E3BC45635044@EXCHANGE.theockendonacademy.com>

Accept-Language: en-GB, en-US

Content-Language: en-GB

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-originating-ip: [10.146.65.31]

Content-Type: multipart/alternative;

boundary="_000_919F91E36141E84C8E78046DD648E3BC45635044EXCHANGEtheocke_"

MIME-Version: 1.0

Return-Path: [email protected]

X-OriginalArrivalTime: 24 Aug 2012 18:05:28.0720 (UTC) FILETIME=[0B368100:01CD8223]

 

--_000_919F91E36141E84C8E78046DD648E3BC45635044EXCHANGEtheocke_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Posted (edited)

Ah no need to read my post above then, didn't refresh the page before posting that, hopefully after a while it should start working then :)

 

It should state when you change settings that it will take that long to update really on forefront

Edited by pritchardavid
Posted
FOPE changes can take up tp 45mins or 2 hours, if the issue is still there, then up the logging on exch server to verbose on the receive connector.
Posted
FOPE changes can take up tp 45mins or 2 hours, if the issue is still there, then up the logging on exch server to verbose on the receive connector.

 

A ducks quack never echos :)

Posted

I have enabled the logging as you have said, I don't know what to do after on that through

 

Also I have found this under the TMG logging

 

e: Firewall service

Status: A connection was abortively closed after one of the peers sent an RST packet.

Rule: [system] Allow SMTP traffic to the local host for mail protection and filtering

Source: Internal (213.199.154.203:50016)

Destination: Local Host (10.146.65.31:25)

Protocol: SMTP

Additional information

Number of bytes sent: 60 Number of bytes received: 40

Processing time: 0ms Original Client IP: 213.199.154.203

 

 

So it looks like the mail is getting to the the TMG server if i'm correct?

 

It it looks like the problem is the tmg server to the exchange server.

 

Are there mean to be any smtp or smtps for a tmg rule?

Posted (edited)

Ok this is how I have setup SMTP rules at the momment

 

1- Firewall Policy, New, Mail Server Publishing Rule

 

2- Mail Server Publishing Rule Name (Exchange)

 

3- Client Access: RPC, IMAP, POP3, SMTP

 

4- Error now comes up saying 'Forefront TMG detected a single adaptor configuration. Server publishing rules are not supported in a single network adaptor configuration. Do you still want to create a server publishing rule?

 

5- yes button

 

6- Ticking all boxes (Outlook RPC, POP3, IMAP4, SMTP, POP3 Secure, IMAP4 Secure, SMTP Secure) I have just tried to just use SMTP and SMTP Secure, and nothing else.

 

7- Type in Server IP Address (10.146.65.20)

 

8- Listen for request from these networks - Use internal with TMG IP Address (10.146.65.31)

 

9- Finish

Edited by pritchardavid
Posted
Ok this is how I have setup SMTP rules at the momment

 

1- Firewall Policy, New, Mail Server Publishing Rule

 

2- Mail Server Publishing Rule Name (Exchange)

 

3- Client Access: RPC, IMAP, POP3, SMTP

 

4- Error now comes up saying 'Forefront TMG detected a single adaptor configuration. Server publishing rules are not supported in a single network adaptor configuration. Do you still want to create a server publishing rule?

 

5- yes button

 

6- Ticking all boxes (Outlook RPC, POP3, IMAP4, SMTP, POP3 Secure, IMAP4 Secure, SMTP Secure) I have just tried to just use SMTP and SMTP Secure, and nothing else.

 

7- Type in Server IP Address (10.146.65.20)

 

8- Listen for request from these networks - Use internal with TMG IP Address (10.146.65.31)

 

9- Finish

 

Is it actually a single adapter setup, this will break things.

Posted (edited)

The TMG server is a virtual server and it has two virtual network cards. So I'm not sure why its saying that, or is it because I did setup it as a single network adapter topology when I setup TMG. I added the second virtual Ethernet card the other day when this message came up, thinking it would get rid of this error!

 

So you think this is the problem then mate? Does it need changing to a different topology? if so how would you do that a reinstall?

 

Or would UAG provide this in a single network adaptor topology?

 

I wouldn't know what other topology to pick if needed.

Edited by pritchardavid
Posted
I'd go for a reinstall, TMG is a nightmare with its settings, once it gets something in its head its stuck. You also want each adapter in a separate IP subnet so that it can distinguish what is going on.
Posted (edited)

Thanks SYNACK

 

Well I have managed to change to edge firewall by rerunning the wizard, but still no external emails working

 

Might have to reinstall like you said, but that can I check a few things with you please?

 

 

Internal Card

 

- Internal DNS Server IPs?

- No Gateway?

- Normal Subnet Mask 255.255.248/24? (IP Address Range Allocated from the council 10.146.64.1-10.146.71.250)

- IP address 10.146.65.34

 

External Card

 

- Internal DNS Server IPs?

- Normal Gateway Address? (Modem that's the fibre is connected to before our main HP switch)

- What subnet mask?

- IP address which is already nated for a public IP address (Internal is 10.146.65.31 for this)

 

 

Also how to I setup the SMTP rules?

What network do I select for the listener? internal or external or both?

 

Also with our two existing web listeners http/https do they stay in the internal network or now the external network, I'm guessing it stays the same, just want to make sure.

Edited by pritchardavid
Posted

To use it as a firewall it needs to be at the border between two networks, this means that it's external interface would exist on the LEA IP range and the rest of the school would exist NATed behind it in a separate range. I have always found it odd the way that the LEA networks work as they seem to be setup to punish good practice rather than reward it.

 

The external adapter should be on the IP 10.146.65.31 with the subnet mask allocated and the default gateway set to the upstream device. It's DNS should point to the internal AD DNS servers.

 

The internal adapter could use a different network like 172.16.x.x that holds all of your client PCs and servers, again DNS points at AD.

 

The listeners should be on both internal and external.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now



×
×
  • Create New...