topic Re: Two Exchange servers at same network could not send email to in Network Security

Two Exchange servers at same network could not send email to each other

rawsonfang — Mon, 11 Mar 2019 09:09:50 GMT

This is my scenario.

#1 One PIX 515 has three interfaces:Outside, Inside and DMZ1

#2. Two Exchange servers in the Inside interface. Server#1 10.0.1.10 hosts abc.com , Server #2 10.0.86.20 hosts xyz.com

#3. Two Symantec SMTP mail gateway server on DMZ1 interface: SMTP gateway1 - 172.16.1.10, SMTP Gateway2 - 172.16.1.20

#4. SMTP Gateway1 forward both inbound and outbound mail for Exchange server 1

SMTP Gateway2 forward both inbound and outbound mail for Exchange server 2

#5. There are Static NAT for one public IP to each SMTP gateways:

static (dmz1, outside) 200.211.10.10 172.16.1.10 255.255.255.255

static (dmz1, outside) 200.211.10.20 172.16.1.20 255.255.255.255

and inculde ACL to permit both inbound and outbound SMTP port 25

#6. MX record for abc.com is 200.211.10.10

MX record for xyz.com is 200.211.10.20

#7. Both Exchange servers could send and receive Internet emails from outside Mail servers, but could not send email between abc.com and xyz.com

#8.Have tried to use alias command for DNS doctoring, and did not work.

It seems that the PIX outside interface, the both public addresses could not pass traffic to each other.

Is there any configure could be done to allow 200.211.10.10 and 200.211.10.20 to send smtp traffic to each other?

Thanks in advance

Re: Two Exchange servers at same network could not send email to

jgervia_2 — Sat, 16 Dec 2006 21:45:02 GMT

Hello,

I couldn't say more without looking at your configuration, but I'd start out with a

same-security-traffic permit intra-interface

Will allow traffic to go in/out the same interface. This might help.

--Jason

Please rate this message if it solved some or all of your issue/question.

Re: Two Exchange servers at same network could not send email to

msubtain — Mon, 18 Dec 2006 03:00:26 GMT

What MX your exchange servers resolves internally?

ping mx.abc.com from exchange.xyz.com

ping mx.xyz.com from exchange.abc.com

Muhammad

Re: Two Exchange servers at same network could not send email to

rawsonfang — Mon, 18 Dec 2006 14:56:07 GMT

From exchange.abc.com, the MX for the mx.abc.com is 200.211.10.10 and

From exchange.xyz.com, the MX for the mx.xyz.com is 200.211.10.20

Re: Two Exchange servers at same network could not send email to

pengfang — Thu, 21 Dec 2006 19:58:30 GMT

DNS Doctoring should sovle your problem:

1. check your alias command, they should be

alias (dmz1) 172.16.1.10 200.211.10.10 255.255.255.255

alias (dmz1) 172.16.1.20 200.211.10.20 255.255.255.255

2. or your can configure your static with "dns" argument

static (dmz1, outside) 200.211.10.10 172.16.1.10 255.255.255.255 dns

static (dmz1, outside) 200.211.10.20 172.16.1.20 255.255.255.255 dns

3. or modify both exchange server HOST file

mx.abc.com 172.16.1.10

mx.xyz.com 172.16.1.20

In exchange server mx.abc.com ping mx.xyz.com,it should resolved as 172.16.1.20.

if the post help,please rate, thanks

peng