quote:

---

Originally posted by uhhuhyea:
Follow up to my previous question:

We have isa 2000 as the firewall/gateway. I have IIS SMTP configured to forward emails just for my domain to a smart host (Trends IMS.) Is there something special I have to do to get RDNS filtering to work correctly? As it stands all RDNS fails becasue the IIS SMTP service says all domains resolve to the local ip of 127.0.0.1.

---

quote:

---

Originally posted by AndrewM:
Tom,

Is it normal in 2004 for the SMTP Publishing Wizard to only allow inbound access to SMTP?

When I ran the publishing wizard in 2000, it correctly assumed that I wanted to be able to SEND mail from the SMTP server I was publishing.

It doesn't look like 2004 does that. With a similar setup to what you have (published server rule & a deny all rule), my outgoing SMTP sends are denied by the deny all rule. This is a pretty important and not obvious change.

---

quote:

---

Originally posted by Jac Goudsmit:
Interesting article, Tom, and thanks for the hints about the Network Monitoring tool!

I just set up an ISA server 2004 and I'm a little stumped by a similar problem (or maybe not).

My box has 3 networks, LAN, WAN and DMZ. I use NAT network rules from LAN->WAN and DMZ->WAN; there is no network rule that connects LAN and DMZ. For various reasons, I prefer not to use a route rule between DMZ and WAN. You could say I just have two LANs, one that has published servers on it and one that doesn't. The addresses inside the LAN and DMZ don't overlap.

I've set up an SMTP server publishing rule, which works perfectly: no matter where you are (LAN or WAN), you can make a connection to the SMTP server connected to the DMZ, by using one of the ISA server's WAN addresses (it uses two IP addresses on the same WAN port).

I also want to publish the same SMTP server on port 2525, so that off-site workers don't have to deal with ISP-imposed port-25 filtering. So I created a server publishing rule that publishes the same SMTP server on port 2525 on the same external address, and overrides the incoming port to 2525.

The problem is that this works great for connections that come from the External network, but for some reason not from the inside. When I do a telnet from a computer on the LAN to the ISA server's external address, I seem to get connected but all I get is an empty screen, no SMTP signon message. As soon as I type something, the connection is closed without message. ISA monitoring says the connection from my computer is initiated (because of the unrestricted Internal->External rule) but it shows "Unidentified IP Traffic" as protocol. Network Monitor doesn't see any port 25 or 2525 traffic on the DMZ, and no relevant traffic on the LAN (I can paste some data if that helps).

Something similar happens with two other publishing rules that I use to publish an HTTP and HTTPS server on alternate ports: when I connect to them from the outside, no problem. But from the inside: Page could not be displayed.

It appears that any publishing rules that change the port number between source and destination, don't work if the connection is made from another network than the address of the listener. If the packet has to do a three-way hop inside ISA server (from LAN to WAN, then from WAN to DMZ), the ISA server apparently drops the packet if the destination port needs to be changed.

Is this a bug or am I overlooking something? I thought, maybe I should add a rule from internal network to local host, but this is not allowed. Adding a route between LAN and DMZ is not an option: the SMTP server in the DMZ doesn't listen on port 2525.

I also tried allowing incoming connections on ALL networks for the port 2525 listener (instead of just on the one address on the External network) but this has no effect. I tried telnetting to the LAN address of the ISA server instead, no effect either.

Am I forced to use a route rule between DMZ and WAN, instead of a NAT? This would be devastating because I only have two IP addresses available for this particular setup, and I would like to use more than two machines to publish services (actually dividing the services over more than one machine is one of the main reasons I'm setting up the ISA server in the first place).

===Jac

---

quote:

---

Originally posted by Fire:
Do not enable SMTP filter on ISA 2004. The default setting will block some exchange 2000/2003 command and cause some mail problem.

Note for Exchange Server 2000/2004 and ISA2004 Users.

---

quote:

---

Originally posted by uhhuhyea:
Thanks Tom,

Should I forward the emails to another box running iis smtp?

---

quote:

---

Originally posted by uhhuhyea:
I figured out that it does work if you use IP Packet filters instead of Server Publishing.

Thanks for your help.

---

quote:

---

Originally posted by Tinto:
Hi Tom,

I think you should put a RED ALERT in your article, to avoid people falling in a very dangerous pitfall.

If the exchange server is used by internal clients as SMTP server to send mail to the world (as many organizations do) and you configure the publishing rule with "requests appear to come from ISA computer" you can easily get an OPEN RELAY because ISA's internal IP probabily is among the IPs Exchange Server grants mail relaying to.

I know this because the expert who did the first installation of the two isa server in our organization made this mistake... two times
Because of this our public IPs were listed in Spammer's black lists in a few hours.

HTH

---