IronPort C170, can't connect with other subnet than listener's

[flyingJet]

Hello there.

So our ESA has a listener on Mgmt int, it is outgoing mail one (pointed to our exchange). We can get to ESA via ssh or web but only if we are connected to the same subnet as the Mgmt int. Is there a way to enable any subnet to access it?

[Ken Stieers · Accepted solution]

Check your routing table.

Also check your subnet mask on that interface.

[flyingJet]

Hello Ken,

I think with Your help I have found the problem, routing table has only DMZ default gateway (Incoming mail listener) but nothing for our inside int (Outgoing one), adding ip route <subnet> via <internal router> shouldn't mess things up ( i know it should, just want to be double sure  )

[Ken Stieers]

It shouldn't...

I have routes for my internal ranges, pointed at the appropriate routers as needed.

[flyingJet]

Applied static routes to our other subnets and all's good, thanks!