Help on configuring exchange server to use sophos utm9 as smarthost

Do you have multiple WAN interfaces?

Seems like UTM cannot reach the Destination Mail server via Port 25. 

yes, we have 2 isp at eth6 and eth7

eth7 is where my public ip and mx connected

i dont know if this is significant but i  have a masquerading rule

email server > wan on eth7 > email mx ip

Please create a Multipath Rule for SMTP. 

https://community.sophos.com/products/unified-threat-management/f/mail-protection-smtp-pop3-antispam-and-antivirus/78071/sending-outgoing-mails-through-specified-interface

To extend ManBearPig:

You dont have to masquerade Emailserver, since it leave the email to utm.

But, if  the exchange is the only who is allowed to send emails you can try Email Protection in Transparent mode. UTM will try both wans. Or you can create multipath rule only for smtp service

Hi ManBearBig,

the link you provided is not working  https://www.sophos.com/en-us/support/knowledgebase/115322.aspx

but upon checking we already have a multipath rule for smtp

note: globe wan is where my MX ip located

or this is more correct?

Hi ManBearBig,

the link you provided is not working  https://www.sophos.com/en-us/support/knowledgebase/115322.aspx

but upon checking we already have a multipath rule for smtp

note: globe wan is where my MX ip located

or this is more correct?

In first screenshoot, source must be any.

Uncheck: Skip rule on interface error

Hi Ryan and welcome to the UTM Community!

I just scanned the above and it looks like you've gotten good advice here.  You might also want to consult Basic Exchange setup with SMTP Proxy.

Cheers - Bob

hi all,

after i change the multipath rule

any > smtp > any > mx ip interface

i still cant send and receive mails

when sending it just stuck at smtp pool at mail manager

with message delivery logs

Message Delivery Log:
2018-09-29 08:22:48 gmail-smtp-in.l.google.com [64.233.189.27]:25 Connection timed out
2018-09-29 08:24:55 alt1.gmail-smtp-in.l.google.com [64.233.179.27]:25 Connection timed out
2018-09-29 08:27:02 alt2.gmail-smtp-in.l.google.com [74.125.129.27]:25 Connection timed out
2018-09-29 08:29:09 alt3.gmail-smtp-in.l.google.com [64.233.185.26]:25 Connection timed out
2018-09-29 08:31:16 alt4.gmail-smtp-in.l.google.com [173.194.68.26]:25 Connection timed out
2018-09-29 08:31:16 alewdainc@gmail.com R=dnslookup T=remote_smtp defer (110): Connection timed out

any other ideas?

Then you should test both IP for outgoing port 25 it is blocked or not.

Configure one IP one at a time and from your PC telnet alt4.gmail-smtp-in.l.google.com 25.

So do just only one masquerade for one IP

And tell as the results

After that we can go further and help you with that

Tomorrow I am at work and have plenty of time

You could also try Port 25 from SSH.

https://serverfault.com/questions/295067/invoking-telnet-from-two-different-interfaces

Please show us pictures of the Edits of the relevant configurations, Ryan - SMTP Proxy, Multipath rules, etc.

What information does doing #1 in Rulz give you?

Cheers - Bob

Hi All,

i can now send and receive mails using sophos utm9 as smarthost and currently monitoring the mail flow.

what i did was add a SNAT rule

i dont know if this is the best way to do it, but it works for me.

At first, incoming mails was delayed for about 15 minutes, so i disable Greylisting and BATV at advance anti-spam features. please advise me if this is recommended.

Apparently you did something that function. But who other  sends emails from UTM, because you may compromise your IP and be blackilsted. If no one will be not allowed to send emails,I will suggest another method with multipath rule.

1 Put email Protection in Transparent Mode,  In Realying Tab Allow only Exchange.

2 Having 2 wans both as gateways will enable uplink balancing and multipath rule.  In multipath path rule just follow the instructions above for smtp

Hi oldeda,

1 Put email Protection in Transparent Mode,  In Realying Tab Allow only Exchange.

is this what you are saying?

off topic:

upon monitoring the utm mail manager, i noticed that some of the emails were not delivered to my inbox, but on mail manager it says delivered.

on delivery log

2018-10-05 15:07:24 rquiocho@wdainc.com.ph: static_smtp transport succeeded to (local ip of email server)


On Exchange log

Failed
10/5/2018 3:07 PM email server
The message couldn't be delivered.

250 2.6.0 <cb7d354c-06c2-4d55-a438-a22bce8e6ecc@community.sophos.com> Queued mail for delivery

How you configured the Address Verification on Email Protection. Better to leave with callout.

And check the junk to be sure