Problem receiving messages from M$ ISA Server...

[rtmoore4_ironport]

I'm having a problem receiving messages on our Ironport from a M$ ISA Server cluster at another organization. When they try to send us messages and they leave a specific machine (x.x.169.233) it doesn't work. When the messages leave the other machine (x.x.169.237), it works just fine. However, if the .233 machine gets turned off, the .237 machines then fails to send us messages as well. See the following injection debug logfile for specifics:

Tue Jun 14 15:41:33 2005 Info: 18064693 Sent to 'x.x.169.233': '220 mta1.RecipientDomain.edu ESMTP\r\n'
Tue Jun 14 15:41:33 2005 Info: 18064693 Rcvd from 'x.x.169.233': 'EHLO smtp.SenderDomain.edu\r\n'
Tue Jun 14 15:41:33 2005 Info: 18064693 Sent to 'x.x.169.233': '250-mta1.RecipientDomain.edu\r\n250-8BITMIME\r\n250 SIZE 209715200\r\n'
Tue Jun 14 15:41:33 2005 Info: 18064693 Rcvd from 'x.x.169.233': 'MAIL FROM:<User1@SenderDomain.edu> SIZE=4228\r\n'
Tue Jun 14 15:41:33 2005 Info: 18064693 Sent to 'x.x.169.233': '250 sender <User1@SenderDomain.edu> ok\r\n'
Tue Jun 14 15:41:33 2005 Info: 18064693 Rcvd from 'x.x.169.233': 'RCPT TO:<User2@RecipientDomain.edu>\r\n'
Tue Jun 14 15:41:33 2005 Info: 18064693 Sent to 'x.x.169.233': '250 recipient <User2@RecipientDomain.edu> ok\r\n'
Tue Jun 14 15:41:33 2005 Info: 18064693 Rcvd from 'x.x.169.233': 'DATA\r\n'
Tue Jun 14 15:41:33 2005 Info: 18064693 Sent to 'x.x.169.233': '354 go ahead\r\n'
Tue Jun 14 15:41:45 2005 Info: 18064718 Sent to 'x.x.169.233': '220 mta1.RecipientDomain.edu ESMTP\r\n'
Tue Jun 14 15:41:45 2005 Info: 18064718 Rcvd from 'x.x.169.233': 'EHLO smtp.SenderDomain.edu\r\n'
Tue Jun 14 15:41:45 2005 Info: 18064718 Sent to 'x.x.169.233': '250-mta1.RecipientDomain.edu\r\n250-8BITMIME\r\n250 SIZE 209715200\r\n'
Tue Jun 14 15:41:45 2005 Info: 18064718 Rcvd from 'x.x.169.233': 'MAIL FROM:<User1@SenderDomain.edu> SIZE=4211\r\n'
Tue Jun 14 15:41:45 2005 Info: 18064718 Sent to 'x.x.169.233': '250 sender <User1@SenderDomain.edu> ok\r\n'
Tue Jun 14 15:41:45 2005 Info: 18064718 Rcvd from 'x.x.169.233': 'RCPT TO:<User3@RecipientDomain.edu>\r\n'
Tue Jun 14 15:41:45 2005 Info: 18064718 Sent to 'x.x.169.233': '250 recipient <User3@RecipientDomain.edu> ok\r\n'
Tue Jun 14 15:41:45 2005 Info: 18064718 Rcvd from 'x.x.169.233': 'DATA\r\n'
Tue Jun 14 15:41:45 2005 Info: 18064718 Sent to 'x.x.169.233': '354 go ahead\r\n'
Tue Jun 14 15:45:17 2005 Info: 18065031 Sent to 'x.x.169.233': '220 mta1.RecipientDomain.edu ESMTP\r\n'
Tue Jun 14 15:45:17 2005 Info: 18065031 Rcvd from 'x.x.169.233': 'EHLO smtp.SenderDomain.edu\r\n'
Tue Jun 14 15:45:17 2005 Info: 18065031 Sent to 'x.x.169.233': '250-mta1.RecipientDomain.edu\r\n250-8BITMIME\r\n250 SIZE 209715200\r\n'
Tue Jun 14 15:45:17 2005 Info: 18065031 Rcvd from 'x.x.169.233': 'MAIL FROM:<User1@SenderDomain.edu> SIZE=4211\r\n'
Tue Jun 14 15:45:17 2005 Info: 18065031 Sent to 'x.x.169.233': '250 sender <User1@SenderDomain.edu> ok\r\n'
Tue Jun 14 15:45:17 2005 Info: 18065031 Rcvd from 'x.x.169.233': 'RCPT TO:<User3@RecipientDomain.edu>\r\n'
Tue Jun 14 15:45:17 2005 Info: 18065031 Sent to 'x.x.169.233': '250 recipient <User3@RecipientDomain.edu> ok\r\n'
Tue Jun 14 15:45:17 2005 Info: 18065031 Rcvd from 'x.x.169.233': 'DATA\r\n'
Tue Jun 14 15:45:17 2005 Info: 18065031 Sent to 'x.x.169.233': '354 go ahead\r\n'
Tue Jun 14 15:45:19 2005 Info: 18065033 Sent to 'x.x.169.233': '220 mta1.RecipientDomain.edu ESMTP\r\n'
Tue Jun 14 15:45:19 2005 Info: 18065033 Rcvd from 'x.x.169.233': 'EHLO smtp.SenderDomain.edu\r\n'
Tue Jun 14 15:45:19 2005 Info: 18065033 Sent to 'x.x.169.233': '250-mta1.RecipientDomain.edu\r\n250-8BITMIME\r\n250 SIZE 209715200\r\n'
Tue Jun 14 15:45:19 2005 Info: 18065033 Rcvd from 'x.x.169.233': 'MAIL FROM:<User1@SenderDomain.edu> SIZE=4228\r\n'
Tue Jun 14 15:45:19 2005 Info: 18065033 Sent to 'x.x.169.233': '250 sender <User1@SenderDomain.edu> ok\r\n'
Tue Jun 14 15:45:19 2005 Info: 18065033 Rcvd from 'x.x.169.233': 'RCPT TO:<User2@RecipientDomain.edu>\r\n'
Tue Jun 14 15:45:19 2005 Info: 18065033 Sent to 'x.x.169.233': '250 recipient <User2@RecipientDomain.edu> ok\r\n'
Tue Jun 14 15:45:19 2005 Info: 18065033 Rcvd from 'x.x.169.233': 'DATA\r\n'
Tue Jun 14 15:45:19 2005 Info: 18065033 Sent to 'x.x.169.233': '354 go ahead\r\n'

It seems to be failing consistently right after the DATA command. Has anyone else seen anything like this? M$ says they don't see anything wrong with the source system and they made vague references to "having problems sending to e-mail appliances in the past".

Randle

[sandeep_ironport]

Old one but here is what is happening anyways...looks like after the IronPort acknowledges the data command, the 133 server fails to send the data stream. Then the connection restarts all over.

[Corey_ironport]

We've run into problems SENDING to MS servers in the past, when there was a SonicWall TZ170 between them, but I have never had a problem (that I am aware of) RECEIVING from an MS server. The symtoms were sortof similar though. We would send a period on a line by itself to terminate the message, but would never get the 250 Message Accepted message from the MS server. We found out that the TZ170 was dropping the packet. There was a firmware revision released about this time last year for the TZ170 that corrected the issue.
Since this probably isn't exactly the case, but appears similar, you may want to sniff the connection and see if a packet is getting dropped by a firewall/router in the middle.