Any Exchange and ADLS experts out there?

[TSS]

We are moving from Exchange 5.5 on Dial-up to Exchange 2003 on Demon’s ADSL Business service (Non-NAT).

We’ve had a go at configuring Exchange 2003 ourselves and have managed to make it send out email but can’t persuade it to download incoming mail from Demon’s servers. Basically we don’t know what we’re doing and are configuring it using trial and error.

Demon have given us a Mailgate IP address which we’ve tried putting into exchange in various places without success.

If it makes any difference, the ADSL is coming in through a Netscreen ADSL-5GT firewall.

Can anybody give me a quick “Configuring Exchange to Receive Email for Dummies Guide”?

Or would anybody in the Northampton area like to earn some extra cash and come and configure it for us?

Thanks,

TSS

[aldi]

Is it a domain catchall pop3 account that demon's got you or are you receiving SMTP direct?

[Plotloss]

Shot in the dark here as I find mail very confusing

But would it be something to do with your MX record at the ISP?

Someone will be along who knows what they are talking about in a minute I am sure...

[k50 del]

Plotloss said:

Shot in the dark here as I find mail very confusing But would it be something to do with your MX record at the ISP? Someone will be along who knows what they are talking about in a minute I am sure...

I'm trying to wade through the settings on our Exchange server at the moment PL, and my gut feeling says that you are correct with it being an MX record issue, I vaguely remember us having an issue like this when we first switched to ADSL enabled exchange based mail collection.

[aldi]

Just to add, if it is SMTP receiving direct it might be easier to get them to change the MX record of your domain to point to your normal router's internet IP then forward port 25 to the server, rather than messing around trying to have 2 internet IP's. Hope that makes sense?

[TSS]

Thanks for your posts so far everybody.

I think the account is a catchall account because whatever you send to [e-mail] comes through to it and is visible on our online “Demon Webmail” inbox before it’s downloaded by our Exchange 5.5 server. The server then forwards on correctly addressed mail to our workstations.

aldi said:

Just to add, if it is SMTP receiving direct it might be easier to get them to change the MX record of your domain to point to your normal router's internet IP then forward port 25 to the server, rather than messing around trying to have 2 internet IP's. Hope that makes sense?

Aldi that sort of makes sense, although I have to admit I’m not too sure what an MX record is. Am I right in thinking that normally the MX record should point to our Exchange Server's IP address, and you are suggesting getting it to point to the Router and then forwarding that to Exchange?

Were were advised by Demon that we would need a range of IP addresses because we had a mail server as well as a router.

I've tried calling Demon for some support on all this but just get somebody who barely speaks English and is no use whatsoever

[BliarOut]

What's the domain name, I'll have a poke around in the MX records and see what I can figure out for you. (PM me with it if need be)

Once we know which IP's are on which device we'll figure the way forward. Most likely you'll need to forward port 25 on the firewall to the internal IP address of the Exchange server.

Also, what type of Demon account is it?

[plasticpig]

A few things:

Is your Firewall allowing traffic on port 25 from Demons mail server IP address?
A mailgate IP address will probably be the public IP adress you need to assign to the network card on your server.

This means that if you have NAT switched on your Router/Firewall it will not work.

If you want to leave NAT on your router needs to have the capability to map a public IP address to a private IP address (then you dont need to change the mail server IP address to the mailgate IP adress). Effectivley this saying route all incoming packets on port 25 from demons mail servers IP address to your mail servers local private IP address.
then you can make it work. I have never heard of the bit of Kit you have so I dont know its capabilities.

Check with Demon to make sure the they have an MX record on their DNS servers pointing to your mailgate IP address. All an MX record (mail exchange record) does is point to the server responsible for handling Email for a domain. In this case the server which has your mailgate IP adress.

You need to set up the SMTP Virual server on your mail server.

[BliarOut]

Ignore my question about what sort of Demon account it is

Is it for the domain on your profile? If it is, then mail is being forwarded to 195.50.105.XXX Is that what you expect? I can check your firewall/port forwarding from here once I know the correct domain

[TSS]

BliarOut said:

Ignore my question about what sort of Demon account it is Is it for the domain on your profile? If it is, then mail is being forwarded to 195.50.105.XXX Is that what you expect? I can check your firewall/port forwarding from here once I know the correct domain

Hi BlairOut, the domain is pytec.co.uk

Thanks for your help

[TSS]

plasticpig said:

A few things: Is your Firewall allowing traffic on port 25 from Demons mail server IP address? A mailgate IP address will probably be the public IP adress you need to assign to the network card on your server.

I've had a look around our firewall settings and I can't find anything about ports. But not knowing anything about firewalls I may be missing something obvious.

plasticpig said:

This means that if you have NAT switched on your Router/Firewall it will not work. If you want to leave NAT on your router needs to have the capability to map a public IP address to a private IP address (then you dont need to change the mail server IP address to the mailgate IP adress). Effectivley this saying route all incoming packets on port 25 from demons mail servers IP address to your mail servers local private IP address. then you can make it work. I have never heard of the bit of Kit you have so I dont know its capabilities.

I don't know if it can do this either I'm afraid.

plasticpig said:

Check with Demon to make sure the they have an MX record on their DNS servers pointing to your mailgate IP address. All an MX record (mail exchange record) does is point to the server responsible for handling Email for a domain. In this case the server which has your mailgate IP adress.

Thanks, I'll give them a call.

plasticpig said:

You need to set up the SMTP Virual server on your mail server.

Please can you explain what this is and how to set it up. Is it part of Exchange?

Thanks,

TSS

[BliarOut]

Ok, you're using the Demon punts.

MX Lookup said:

Non-authoritative answer: pytec.co.uk MX preference = 50, mail exchanger = punt-2.mail.demon.net pytec.co.uk MX preference = 50, mail exchanger = punt-1.mail.demon.net pytec.co.uk nameserver = ns0.demon.co.uk pytec.co.uk nameserver = ns1.demon.co.uk pytec.co.uk nameserver = ns2.demon.net ns2.demon.net internet address = 209.246.126.109

Demon said:

Because your machine connects to the Internet intermittently, we operate a mail store-and-forward service. Mail destined for you is stored on clusters of machines called (for obscure historical reasons) punts. There are two punt clusters located at our Network Facilities Centre (NFC) at Docklands (Telehouse). This gives us resiliency in case of network problems: if there is a temporary problem with a punt cluster, you can still get Email held on the other punt cluster and new Email will still arrive and be stored there. If you choose to access your Email by SMTP rather than by POP3 then all you need to do is start an SMTP server (also known as a daemon) on your machine to listen for incoming connections. Those customers who use firewalls or otherwise place restrictions on external connections to their machines (this applies mainly to Unix software) should allow connections from hosts with IP addresses in the range: 194.217.242.0 to 194.217.242.255 on the default SMTP port (25). Customers using permanently connected services such as Business Broadband or Leased Line products, which have a direct MX record pointing to their SMTP server (also known as a mailgate) should not use these restrictions as they only apply to mail stored on our Punt servers.

According to this, you should have a direct MX record, which the above shows isn't the case.

To get what you have working, you'll need a firewall exception on port 25 for 194.217.242.0 to 194.217.242.255( ie. 194.217.242.0 255.255.255.0) to the IP address of your Exchange server and port forwarding set up to forward all traffic on port 25 from your router to your exchange server.

The problem isn't with your exchange server, it just isn't seeing anything coming back on port 25 from the outside world.

[BliarOut]

TSS said:

plasticpig said: A few things: Is your Firewall allowing traffic on port 25 from Demons mail server IP address? A mailgate IP address will probably be the public IP adress you need to assign to the network card on your server. I've had a look around our firewall settings and I can't find anything about ports. But not knowing anything about firewalls I may be missing something obvious. plasticpig said: This means that if you have NAT switched on your Router/Firewall it will not work. If you want to leave NAT on your router needs to have the capability to map a public IP address to a private IP address (then you dont need to change the mail server IP address to the mailgate IP adress). Effectivley this saying route all incoming packets on port 25 from demons mail servers IP address to your mail servers local private IP address. then you can make it work. I have never heard of the bit of Kit you have so I dont know its capabilities. I don't know if it can do this either I'm afraid. plasticpig said: Check with Demon to make sure the they have an MX record on their DNS servers pointing to your mailgate IP address. All an MX record (mail exchange record) does is point to the server responsible for handling Email for a domain. In this case the server which has your mailgate IP adress. Thanks, I'll give them a call. plasticpig said: You need to set up the SMTP Virual server on your mail server. Please can you explain what this is and how to set it up. Is it part of Exchange? Thanks, TSS

SMTP is installed on Exchange, ignore Exchange for now. This article should tell you how to set up your firewall

http://5xt.support.netscreen.safeharbor.com/knowbase

Edit: In step 6, put in your external IP address in the top box with a 255.255.255.255 mask, and in the lower box put your Exchange servers internal IP addres. In step 15, select SMTP instead of HTTP. That should do it.

>> Edited by BliarOut on Wednesday 16th November 14:02

[TSS]

BliarOut said:

TSS said: plasticpig said: A few things: Is your Firewall allowing traffic on port 25 from Demons mail server IP address? A mailgate IP address will probably be the public IP adress you need to assign to the network card on your server. I've had a look around our firewall settings and I can't find anything about ports. But not knowing anything about firewalls I may be missing something obvious. plasticpig said: This means that if you have NAT switched on your Router/Firewall it will not work. If you want to leave NAT on your router needs to have the capability to map a public IP address to a private IP address (then you dont need to change the mail server IP address to the mailgate IP adress). Effectivley this saying route all incoming packets on port 25 from demons mail servers IP address to your mail servers local private IP address. then you can make it work. I have never heard of the bit of Kit you have so I dont know its capabilities. I don't know if it can do this either I'm afraid. plasticpig said: Check with Demon to make sure the they have an MX record on their DNS servers pointing to your mailgate IP address. All an MX record (mail exchange record) does is point to the server responsible for handling Email for a domain. In this case the server which has your mailgate IP adress. Thanks, I'll give them a call. plasticpig said: You need to set up the SMTP Virual server on your mail server. Please can you explain what this is and how to set it up. Is it part of Exchange? Thanks, TSS SMTP is installed on Exchange, ignore Exchange for now. This article should tell you how to set up your firewall http://5xt.support.netscreen.safeharbor.com/knowbase Edit: In step 6, put in your external IP address in the top box with a 255.255.255.255 mask, and in the lower box put your Exchange servers internal IP addres. In step 15, select SMTP instead of HTTP. That should do it. >> Edited by BliarOut on Wednesday 16th November 14:02

Thanks BlairOut, I'm afraid we get stuck on step 3 of that guide, our screen looks like the one below and doesnt have an ethernet3 interface listed.

Name IP/Netmask Zone Type Link Configure
adsl1 80.177.57.57/32 Untrust Layer3 up Edit
serial 0.0.0.0/0 Null Unused down Edit
trust 192.168.1.1/24 Trust Layer3 up Edit
untrust 0.0.0.0/0 Null Unused down Edit
vlan1 0.0.0.0/0 VLAN Layer3 down Edit

[BliarOut]

adsl1 80.177.57.57/32 Untrust Layer3 up Edit

That's the one you want

In step 6/7 your Exchange server IP address will be 192.168.1.x

[malman]

I usually use VIP on the netscreens for smtp mapping but a MIP should work ok.

I don't know if they do this for ADSL but demon used to use your radius login as an indication that you were online and then deliver smtp to the IP address they had assigned you (static). The MX records for your domain would show as demon as they collected all your mail even when you are online. This worked well for ISDN accounts. A lookup of MXs for pytec.co.uk looks identical to one of my customers that is still using the demon ISDN/smtp stylee

>> Edited by malman on Wednesday 16th November 14:30

[TSS]

BliarOut said:

adsl1 80.177.57.57/32 Untrust Layer3 up Edit That's the one you want In step 6/7 your Exchange server IP address will be 192.168.1.x

OK, we’ll try that a bit later this afternoon when we have time to connect up the new server and I’ll report back.

I presume our external IP address we put in the top box in the top box is 80.177.57.57

[BliarOut]

TSS said:

BliarOut said: adsl1 80.177.57.57/32 Untrust Layer3 up Edit That's the one you want In step 6/7 your Exchange server IP address will be 192.168.1.x OK, we’ll try that a bit later this afternoon when we have time to connect up the new server and I’ll report back. I presume our external IP address we put in the top box in the top box is 80.177.57.57

Once you do that it should just work. Be aware though that any e-mail will then end up on your new exchange server until you hook it up to the network. You might want to check it through webmail first...

If it works, the MIP will need taking off once you have finished testing.

(yes I know it could be redirected to the EX 5-5 server, but that's insecure by default.... Worms everywhere etc!!)

[plasticpig]

plasticpid said:

You need to set up the SMTP Virual server on your mail server.

TSS said:

Please can you explain what this is and how to set it up. Is it part of Exchange? Thanks, TSS

You can find SMTP Virtual Server in Exchange system manager under Servers/Protocols/SMTP/Default SMTP Virtual Server.

You can setup message size limits. Limit the number of recepients and most importantly make sure your SMTP server is not an open relay.

[TSS]

plasticpig said:

plasticpid said: You need to set up the SMTP Virual server on your mail server. TSS said: Please can you explain what this is and how to set it up. Is it part of Exchange? Thanks, TSS You can find SMTP Virtual Server in Exchange system manager under Servers/Protocols/SMTP/Default SMTP Virtual Server. You can setup message size limits. Limit the number of recepients and most importantly make sure your SMTP server is not an open relay.

Thanks plasticpig





>> Edited by TSS on Wednesday 16th November 18:00