Skip to main content

Ports that need to be open on Firewall for Edge Transport servers

Ports that need to be open on firewall for Edge Server subscription with Hub Server to function properly:

For Inbound traffic:
SMTP - TCP port 25 (from Internet)
SMTP - TCP port 25 (from Edge server to Hub server on internal network)
For Outbound traffic:
SMTP - TCP/UDP port 25 (from Edge to Internet)
SMTP - TCP/UDP port 25 (from Hub to Edge server)
LDAP for EdgeSync - TCP port 50389 (from Hub to Edge server) Secure LDAP for EdgeSync - TCP port 50636 (from Hub to Edge server)

Since Edge server needs to communicate with Hub server it is important that it can resolve Hub transport servers by FQDN and Hub transport servers must be able to resolve Edge servers by its FQDNs.

To accomplish this you need to either open 53 (DNS) port and configure internal network adapter to use internal DNS but as a security precaution I would suggest to enter DNS records for Edge servers on local DNS manually and to fill hosts file on Edge servers with FQDNs for Hub transport servers.

Labels:

Comments

  1. AnonymousMay 3, 2009 at 2:09 PM

    And if I had Exchange 2007 SCC mailbox, hub and cas servers isolated from de internal LAN behind a firewall(NOT a DMZ, for security purposes) what ports need to be open for internal MAPI Clients?

    ReplyDelete
  2. Dušan KošarićMay 3, 2009 at 6:21 PM

    Read this article: http://support.microsoft.com/kb/270836
    Be aware of what is supported!

    ReplyDelete

Post a Comment

Popular posts from this blog

Error "<#5.5.2 smtp;554 5.5.2 Invalid data in message> #SMTP#" when you send attachment in your mail

Some users were receiving error <#5.5.2 smtp;554 5.5.2 Invalid data in message> #SMTP# when they sent message with attachment. The problem is when attached document name is longer than 50 characters. Some Firewalls have header size restriction and that limit blocks this messages to be sent. To correct this, change header limit on affected Firewall or shorten the name of the document you are sending (which is probably not good permanent solution).******
Update #1: Default header size limit in Exchange 2007 is 64K.Update #2: It might be the SMTP version problem. Mail is rejected with CONTENT-DISPOSITION error (overly long message header field for CONTENT-DISPOSITION) but not for all SMTP servers (same mail sent through different SMTP servers). If you send mail with attachment that has name longer than 50 characters from Exchange 2007 directly through DNS you may encounter this error, but if you send same mail from Exchange 2007 through smart host (other than Exchange) mail is d…
12 comments
Read more

Change SMTP port 25 in Exchange 2007, 2010

For some reason you might want to change default SMTP port number 25 Exchange 2007 is using. Exchange 2007 uses RECEIVE AND SEND connectors, one for receiving mails and other for sending mails (obviously ;)
So you need to change ports on those connectors. I will not say those two, because you might be using more than two.
You change Receive connector port by opening the connector properties in Exchange Management Console --> Hub Transport --> RECEIVECONNECTORNAME --> Properties --> Network --> Local IP Addresses (Edit Receive Connector Binding)
Just to clarify what "Local IP Addresses" and "Remote Servers" are (from Exchange 2007 help), because I find it little bit confusing: Use these local IP Addresses to receive mail Use this list to specify the IP addresses and port numbers on which this Receive connector listens for incoming mail. Receive mail from remote servers which have these IP addresses Use this list to specify the remote IP address range fr…
12 comments
Read more

How to Remove an IP Address from a Blacklist SpamCannibal

Go to http://spamcannibal.org/cannibal.cgiIn the right side menu click Lookup IPEnter mail server IP address into the field and click Lookup IPCheck why you got listed in the first placeIf your mail server is missing PTR (reverse DNS) record, add itIf other problem resolve it firstIf the problem is resolved go again to http://spamcannibal.org/cannibal.cgiClick Contact in the right side menuScroll to the bottomEnter your IP addressEnter your EmailDescribe why you got listed and what you did to solve the problemSubmit NOTE: Don't try to get de-listed from any blacklist BEFORE you solved the problem added you to the blacklist in the first place


Post a Comment
Read more