This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Inbound mail not being delivered since update to 9.100-16

Hi,
I upgraded from 9.006005 to 9.100-16 the other day and since the upgrade no inbound mail has been delivered to my exchange server. If I look at the SMTP spool in mail manager I can see all the inbound email marked as "Waiting"

Looking at the SMTP Proxy log i can see the following

2013:05:16-08:47:00 Firewall exim-out[2563]: 2013-05-16 08:47:00 1UcUEQ-0001k3-7N == ***@***.com R=static_route_hostlist T=static_smtp defer (-53): retry time not reached for any host
2013:05:16-08:47:00 Firewall exim-out[2565]: 2013-05-16 08:47:00 1Uce4k-0006su-28 == ***@***.com R=static_route_hostlist T=static_smtp defer (-53): retry time not reached for any host
2013:05:16-08:47:00 Firewall exim-out[2575]: 2013-05-16 08:47:00 1Uca0y-0005XD-9s == ***@***.com R=static_route_hostlist T=static_smtp defer (-53): retry time not reached for any host
2013:05:16-08:47:00 Firewall exim-out[2577]: 2013-05-16 08:47:00 1UcgtQ-0005xW-6d == ***@***.com R=static_route_hostlist T=static_smtp defer (-53): retry time not reached for any host
2013:05:16-08:47:00 Firewall exim-out[2579]: 2013-05-16 08:47:00 1UcGht-00015U-0A == ***@***.com R=static_route_hostlist T=static_smtp defer (-53): retry time not reached for any host
2013:05:16-08:47:00 Firewall exim-out[2581]: 2013-05-16 08:47:00 1UcZna-00053S-6T == ***@***.com R=static_route_hostlist T=static_smtp defer (-53): retry time not reached for any host
2013:05:16-08:47:00 Firewall exim-out[2583]: 2013-05-16 08:47:00 1UceZY-0008BN-CM == ***@***.com R=static_route_hostlist T=static_smtp defer (-53): retry time not reached for any host
2013:05:16-08:47:00 Firewall exim-out[2585]: 2013-05-16 08:47:00 1UcXEi-0007wj-97 == ***@***.com R=static_route_hostlist T=static_smtp defer (-53): retry time not reached for any host
2013:05:16-08:47:00 Firewall exim-out[2587]: 2013-05-16 08:47:00 1UcCtk-0003mw-G4 == ***@***.com R=static_route_hostlist T=static_smtp defer (-53): retry time not reached for any host

and if I select a couple of emails and click retry I also see

2013:05:16-08:47:50 Firewall exim-out[2657]: 2013-05-16 08:47:50 1UcoAi-0003Jg-B0 Remote host 172.16.1.2 [172.16.1.2] closed connection in response to MAIL FROM: SIZE=29750
2013:05:16-08:47:50 Firewall exim-out[2656]: 2013-05-16 08:47:50 1UcoAi-0003Jg-B0 == ***@***.com R=static_route_hostlist T=static_smtp defer (-18): Remote host 172.16.1.2 [172.16.1.2] closed connection in response to MAIL FROM: SIZE=29750
2013:05:16-08:47:50 Firewall exim-out[2659]: 2013-05-16 08:47:50 1UckAy-0008RQ-5Z Remote host 172.16.1.2 [172.16.1.2] closed connection in response to MAIL FROM: SIZE=12437
2013:05:16-08:47:50 Firewall exim-out[2658]: 2013-05-16 08:47:50 1UckAy-0008RQ-5Z == ***@***.com R=static_route_hostlist T=static_smtp defer (-18): Remote host 172.16.1.2 [172.16.1.2] closed connection in response to MAIL FROM: SIZE=12437
2013:05:16-08:47:50 Firewall exim-out[2661]: 2013-05-16 08:47:50 1Uchw6-00020O-Gu Remote host 172.16.1.2 [172.16.1.2] closed connection in response to MAIL FROM: SIZE=3147
2013:05:16-08:47:50 Firewall exim-out[2660]: 2013-05-16 08:47:50 1Uchw6-00020O-Gu == ***@***.com R=static_route_hostlist T=static_smtp defer (-18): Remote host 172.16.1.2 [172.16.1.2] closed connection in response to MAIL FROM: SIZE=3147
2013:05:16-08:47:51 Firewall exim-out[2663]: 2013-05-16 08:47:51 1Ucicg-00043v-4W Remote host 172.16.1.2 [172.16.1.2] closed connection in response to MAIL FROM: SIZE=73288
2013:05:16-08:47:51 Firewall exim-out[2662]: 2013-05-16 08:47:51 1Ucicg-00043v-4W == ***@***.com R=static_route_hostlist T=static_smtp defer (-18): Remote host 172.16.1.2 [172.16.1.2] closed connection in response to MAIL FROM: SIZE=73288
2013:05:16-08:47:51 Firewall exim-out[2664]: 2013-05-16 08:47:51 1UcrIk-0004FZ-DO Remote host 172.16.1.2 [172.16.1.2] closed connection in response to MAIL FROM: SIZE=26987
2013:05:16-08:47:51 Firewall exim-out[2655]: 2013-05-16 08:47:51 1UcrIk-0004FZ-DO == ***@***.com R=static_route_hostlist T=static_smtp defer (-18): Remote host 172.16.1.2 [172.16.1.2] closed connection in response to MAIL FROM: SIZE=26987

in the above logs I have replaced internal email addresses with ***@***.com and external addresses with yyy@yyy.com.

All internal email is working as well as sending email outbound, its just inbound that is the issue.

I'm not sure what to do to fix this?

Regards

Karl

This thread was automatically locked due to age.

0 Ol Deda over 11 years ago

is the same in 2003 too
and read the private message on your inbox not mine [:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 Firestorm over 11 years ago

[:)] I've read the message and replied back. I have just sent email from 3 different machines on my LAN using telnet and all messages arrive so exchange isn't refusing the email or dropping the connection
Cancel
Vote Up 0 Vote Down

Cancel
0 Ol Deda over 11 years ago

telnet or not is the same. 172.16.1.1 must allowed to relay on 172.16.1.2
I just sent an email to hell-user@sea***.com.
your Utm or exchange must send back "unknown address", but still nothing
Cancel
Vote Up 0 Vote Down

Cancel
0 Firestorm over 11 years ago

Hi Olsi,
I have done as you requested in your pm but every time i reply to it it doesn't show in my outbox so not sure if you got the reply.

I can see the email you sent from your gmail account in the SMTP pool but it is the same as all the others, it just sites there saying waiting. I have also checked "Default SMTP virtual server" settings on Exchange and the UTM is allowed to relay so its not that.

This really has to be something with the upgrade as it was working fine for the last year and nothing has changed on the exchange side

Thanks

Karl
Cancel
Vote Up 0 Vote Down

Cancel
0 Ol Deda over 11 years ago

Karl you have implemented certificate verification or something like that in Exchange?
Where is sited exchange in DMZ, single NIC or behind UTM?
Cancel
Vote Up 0 Vote Down

Cancel
0 Firestorm over 11 years ago

Hi Olsi,
No there is no certificate based authentication. The exchange has a single nic and is on the LAN with the UTM in front of it

                Internet
                    |
                    |
                  UTM
                    |
                    |
                 Switch
                    |
                    |
                 Exchange

as I mentioned though nothing has changed on the exchange side and I haven't had a single emailed delivered to my exchange server since the UTM was upgraded to 9.1

Thanks again

Karl
Cancel
Vote Up 0 Vote Down

Cancel
0 Ol Deda over 11 years ago

No email in my inbox from your utm or exchange, maybe someone who knows the packets better have to look wreshark printscreen. See the forum inbox
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 11 years ago

I wonder if there isn't a TLS problem.  On the 'Advanced' tab, try adding the Host definition for your Exchange server to 'Skip TLS negotiation hosts/nets' and Apply.

You may need to disable the requirement for TLS in Exchange, too.  This shouldn't present any risk as the UTM is handling encryption in public traffic.

Was that work-around successful?

Cheers - Bob
PS Oftentimes, this is a DNS issue.  Try removing your forwarders, Apply, adding the Forwarders back in, Apply.

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Firestorm over 11 years ago

Hi Bob,
You hit it on the head, thank you!! adding the host definition for my exchange server to the 'Skip TLS negotiation hosts/nets' section fixed the problem. Its very odd as my exchange isn't set up to use TLS and it was working right up to the upgrade to 9.1 but anyway...

I would also like to say thank you to Olsi for all his help today and once again thanks Bob

Karl
Cancel
Vote Up 0 Vote Down

Cancel
0 Ol Deda over 11 years ago

Any time
Bob thank you from me too
Cancel
Vote Up 0 Vote Down

Cancel