Email flow to Exchange server stops

Hello,

Thank you for contacting Sophos Community!

For Legacy mode, we request you to have awarrensmtp service in debug and share us the logs when an issue occurs.

Use the below KBA to know service and associated log file.

https://docs.sophos.com/nsg/sophos-firewall/19.5/help/en-us/webhelp/onlinehelp/AdministratorHelp/ServicesAndPorts/DefaultAddressesAndPorts/index.html)

Login to the Firewall CLI, go to option number 5 & 3. Use the below command to add the service in debug.

#service awarrensmtp:debug -ds nosync (Use the same command to disable the debug after collecting the below logs).

#tail -f /log/awarrensmtp.log

For MTA mode, kindly review below KBA:

https://support.sophos.com/support/s/article/KB-000038662?language=en_US

We also advice opening service request as the issue occurs intermittently and hence the team can help you add the services in debug and also can help with how to collect the rotating logs.

Hi Mark Hebblethwaite ,

just want to be sure we understand the situation.

Do I get that right that you don't use neither the legacy mode nor the MTA mode mail proxies on SFOS and your firewall should forward all SMTP traffic directly to your backend Exchange server?

Thank you,

Janos 

I have one Sophos with a business rule delivering ports 25, 465 and 587 to the internal exchange server. The second unit is acting as an MTA.

Email is the first service that users notice "We've not received any email for a while". Try using putty from external and unresponsive. Try accessing browser-based services like OWA or ECP and neither work.

Connect to the Sophos and reboot - everything starts working again.

This happens maybe once every 6-9 months. The sophos gets rebooted for firmware updates about 2 weeks after an update is released.