Cant receive mail from outside after server reboot

[glamprecht1]

Hello,

Not sure what when wrong.

We have had a good working exchange 2003 server on Windows server 2003. Latest SPs on server and exchange. It’s been well for a couple of years but the hardware is old and becoming problematic. I added a second server with the intention of replacing the first one. We will call this one server2. Right away I was able to send and receive mail from this server. For several weeks I have been slowly migrating mailboxes to the new server and everything has been working fine on both servers. Today I rebooted server one and we can no longer receive mail from the outside. All internal mail works without a problem. The reboot on server1 (old server) seems to have done something.
I am not very savvy with Exchange and am learning as I go. I felt that I was following all documentation fairly well. Like I said everything was working quite well for weeks until I rebooted server1 today. Now for some reason, no user can receive mail from the outside on either server.

Any tips? I am going nuts here.

 

[markdmac]

First check your NAT to verify that port 25 traffic is still being delivered to the old server. Can you telnet to that server on port 25?

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[glamprecht1]

Telneting from the outside brings up a blank screen with a blinking cursor.
Tenetting from the inside brings up a successfull response.

Not sure what to do from here. Its just odd that it works for two years and after a reboot these problems start.

Any other next steps?

Thanks

Gary

 

[people3]

Hi Gary,

Have you made any changes to your firewall, is port 25 still forwarding to the ip of the old server, as sugested by mark.

Have all the exchange services started ok? and errors in the event log.

Can you browse the internet on the server?

And have you tried another reboot?

have you tried disabling the antivirus and firewall as a test?


does exchange send mail out directly or through a smart host?

Cheers

 

[glamprecht1]

People3

No changes have been made to the firewall.

The only error that shows up in the logs is this one. The logs are very clean with the exception of this error

Event Type: Error
Event Source: MSExchangeSA
Event Category: MAPI Session
Event ID: 9175
Date: 7/7/2009
Time: 7:07:14 AM
User: N/A
Computer: NOHEXCP1
Description:
The MAPI call 'OpenMsgStore' failed with the following error:
The Microsoft Exchange Server computer is not available. Either there are network
Problems or the Microsoft Exchange Server computer is down for maintenance.
The MAPI provider failed.
Microsoft Exchange Server Information Store
ID no: 8004011d-0526-00000000

The logs are solid white with the exception of this one.

Yes I can browse the internet on the server.

I have tried at least 5 or 6 reboots on both servers.

I did not try to disable antivirus and there is not a firewall running on the exchange server.

I did get an odd email this morning from an old service that runs on the server. We used to use GFI mail security up till about a year ago and ended up going to an external vendor for spam/virus control. GFI was never removed and has not caused a problem. Early this morning I got an email saying that a critical problem happened on the virus scan via GFI. I removed GFI from the server and about 30 min later mail started to come in. Coincidence? The server worked fine until it was rebooted.
It does seem to be working now but something tells me that there is more to this. Are there any additional things I can do or look at to investigate further? Since I am at work I am unable to telnet in from the outside but I suspect that this is now working.

Gary

 

[markdmac]

If mail is coming in, you would be able to telnet. Sounds like the GFI is the culprit. All was well until you rebooted and then GFI encountered a problem that blocked SMTP.

Since you are using a 3rd party spam filtering, you should lock your SMTP down to only accept port 25 traffic from the 3rd party.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[58sniper]

If you telnet over 25 and get a blinking cursor, something could be between you and the server, like a Cisco firewall with ESMTP inspection enabled. I've seen that cause all kinds of problems with dropped messages.

I suspect when the services were trying to start on the reboot that the GFI stuff fell flat.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[glamprecht1]

Thanks for all of the replies everyone.

MarkDmac; we restrict outgoing but not incoming traffic on port 25.I will look into this. Thanks for the suggestion.

58sniper; the blinking Cursor was early this morning when it was still down. I will try again from home to see what the behavior is. We Do have Cisco ASA's so if need to be I will look into the ESMTP Inspection settings. At least I will know what to expect when troubleshooting later in life.

GFI was very good to us for several years. We just got tired of managing users spam so we went with an external solution that the user can manage themselves. I should have removed the GFI install at that time but that’s how it is.

Thanks again.

Gary

 

[compuveg]

A little late, I realize, but a great free service will check common ports, and some other information, on whatever host you specify. The ports it checks are FTP, SMTP, HTTP, POP3, and IMAP. It is great for checking connectivity to a site from somewhere other than your network.

http://centralops.net/co/domaindossier.aspx