Hybrid Exchange change of SMTP relay connector

[Anton5032]

Hi All

So we have Hybrid Exchange environment, with few 2010 Exchange boxes on-prem, 1x Exchange 2016 on-prem (as the hybrid) and O365 tenant.

Until now we were using one of the EX2010 boxes as main smtp relay and it`s working great. Now we want to switch that role and move it to the hybrid 2016 Exchange. To beused by the internal scan2email, apps, etc for sending anonym.

All FW rules are configured correctly.

The ext IP address of the 2016 box is added as trusted connector in EXO

I have send/recieve connectors configured on the 2016 box

The problem:

If I go and test telnet (EXO ext IP) 25 - from within the EX2010 box, I got connection and response and all is nice and shiny

If I try to do the same from the hybrid 2016 box - got connection open and blank screen. Stays for about 60 seconds and then Connection closed. No need to say that it is not forwarding anything if I try lets sat scan2email from one of the printers.

I found in the logs some errors saying socket error - but it doesnt make sense because the fw shows all connections as allowed and as I said the fw rules are the same for EX2010 and EX2016 boxes, the difference is that they are presented with different ext IPs, but both of them added as trusted in EXO Admin

Any ideas? I cant find any other reason why it would not establish smtp connection to the EXO ?

[#2]

@Anton5032 

Hmm, that's interesting.  Are you able to share a screenshot of the receive connector you have created on your Exchange 2016 server please?

Also, could you share the socket error you are seeing too?

[#3]

@PeterRisingthanks for the reply

this is the receive connector (screenshot) and under security we have marked ONLY - Anonymous

Scoping is the internal printer network

Looks like the receive connector on the Exchange 2016 is ok, but then if try to open SMTP 25 to Outlook.office.com from the Exchange 2016 all I am getting is blank screen and nothing else. When I try to do the same from the old 2010 Exchange box it all works perfectly. As I said on the FW both boxes have identical rules. Not sure why EXCH2016 -> Outlook.office.com:25 not working

[#4 · Accepted solution]

@Anton5032 

Whenever I setup a connector for this purpose on an Exchange 2016 Server, I always set the security tab options as follows;

I would definitely double and triple check your firewall rules too.  Do you definitely have the Exchange Online IP's all allowed for the Exchange 2016 server?

[#5]

@PeterRising 

THANK YOU!

That definitely did the trick, although now it looks like whoever created the send connector didnt do the work right - it is only relaying emails to internally and if try to send externally (ie: gmail) - nothing happens.

I can see there is a separate send connector for that 2016 box and another one which serves the on-prem (which obviously works fine at the moment). So, I am not sure how the 2016 send must looking.

Current config:

delivery:

Route via smart hosts (address of our securemx)

Smart host auth: NONE

Scoping:

Address Space - SMTP *

Source server: ADDRESS of the 2016 Exch box

Any help will be greatly appreacited!

[#6]

Found the problem!

FW issue - someone forgot to fix the src ip masq and the requests were going with the default ext ip instead the dedicated one

Thanks for the help!