Dual gateways in single nic on exchange 2003 box?

[N3O]

Howzit guys.

Here is what I have: 2 x firewalls, both configured with different static IP's from different ISPs. My internal domain is company1.local and we always received mail for company1.co.za via static ip 41.100.100.50.

The company changed its name but didnt want the downtime and teething issues at the start of the year that comes with changing the internal domain to company2.local, so I configured exhange to be able to receive and send using the company2.co.za addresses. The company2.co.za is hosted by a different ISP than company1.co.za. Simply pointed company2.co.za's mx to the existing static ip. That all works hundreds.

Now we have another static IP so I configured this on the second firewall, 41.200.200.60. The two firewalls have internal ip's of (a) 192.168.1.3 and (b) 192.168.1.254.

So company1.co.za's mx is pointing to 41.100.100.50 and company2.co.za's mx to 41.200.200.60. The exchange box's nic is configured with IP 192.168.1.7 and i added the two gateways, 192.168.1.3 and 192.168.1.254. Obviously I pointed all mail traffic on the two firewalls to point to 192.168.1.7.

Now im not receiving any mail. Now I've read and understand that the box is not going to know which gateway to use if I set them to have automatic metrics, but even if I specify the metrics, this will only take effect if the one gateway is unreachable - but the higher metric will always be used when available.

HOw do I get my mail to deliver to my exchange!?

Let me know - timeout for retries is almost up and i dont have spooling at the ISP's so Im going to start losing mail!

Thanks!!

 

[bubbatentoe]

Sounds like you have maybe 1 or maybe 2 problems
only one issue: routing issues on Firewall2. (41.200.200.60)
two issues: the above + did you configure an Exchange domain alias so Exchange server is able to receive mail for both company1 and company2 or did you simply change the recipient policy so Exchange receives mail for company2 only?

Normally in a situation like this (multiple internet facing links with firewalls) you'd have multiple MX records (2 or more MX records for each domain name)
When incoming mail is sent to either domain, DNS will try the primary MX first, if it's offline it will switch to the secondary(ies).



Sounds like you need something like this:

company1 MX record with preference 1 (primary) pointing to firewall1 (41.200.200.50)
company1 MX record with preference 10 (secondary) pointing to firewall2 (41.200.200.60)
company2 MX record with preference 1 (primary) pointing to firewall1 (41.200.200.50)
company2 MX record with preference 10 (secondary) pointing to firewall2 (41.200.200.60)

This way, all mail (for both domains) will first go to firewall1 as long as its online (41.200.200.50) - seeing as this firewall used to work fine it should continue doing so (as long as you didn't t mess with it).
Once mail is flowing again via firewall1 you can relax and look at firewall2 at your leisure.

To test mail forwarding on firewall2, connect a PC directly to the external (internet facing) port of firewall2 and try to telnet to your mail server (on port 25).
Instructions here: http://support.microsoft.com/kb/153119

For Exchange server to receive mail for different domains (different to your AD domain) you have to configure domain aliases.
See here: http://www.petri.co.il/configure_exchange_2000_2003_to_receive_email_for_other_domains.htm


best of luck.

 

[N3O]

Hi thanks for the reply.

I probabky shouldve mentioned that the company I work for has a financial dispute with the ISP that hosts company1.co.za domain and they refuse to make mx changes untill its resolved (which is petty since the dispute has nothing to do with the domain and also its from when the company had another name back in 2007).

So Mx changes wouldnt do - else if I could then I'dve just pointed everything to the mx.

Anyway - I got it working. Jeez after so much different configuration tries and routes etc, I completely forgot about DMZ. So I simply put 41.100.100.50's address in 41.200.200.60's dmz and voila - mail's flowing.

Thanks anyway!

Cheers