Exchange 2013 SP1: Edge Transport Server Installation and Configuration
Edge Transport Server has protected many Exchange Infrastructures and we liked to rely on Microsoft since the release of Anti-spam in Exchange 2003 SP2.
Many of us were waiting for the Edge Transport Server to come back in Exchange 2013 and with the Release of SP1 Microsoft gave us Edge Transport Server.
New Edge Transport can only be managed be Exchange management shell until we create a subscription.
Once we configure the subscription, we can manage Edge Transport from the Exchange 2013 SP1 ECP which is CAS 2013 server. This means Edge Transport does not come with a separate EAC or ECP component.
Most of the time we place Edge Transport server in the DMZ.
Let us have a look on the Installation and possible configuration options.
Open the following Ports from your DMZ Firewalls
Internet ß–> EDGE Transport Server
SMTP Port 25
EDGE Transport Server ß–>Intranet
SMTP Port 25 and 2525 – Mailflow
DNS TCP/UDP – 53 – DNS Resolution
RDP TCP 3389 – Remote Desktop
LDAP – 50389 – locally to bind to the AD LDS instance – There is no need to open this port on perimeter firewall.
Secure LDAP – 50636 – Directory synchronization from Mailbox servers to AD LDS
This will be a server in the work group with the domain name of the Active directory domain in the Full Computer name as suffix. See the screen shot.
We need to point the DNS to the Active Directory DNS on the Corporate firewall LAN. Only LAN DNS and no Public DNS. Let the DNS server do the forwarding or use root hints.
Install the ADLDS from Add Roles in the server manager. There is no configuration required. Exchange will configure it.
Install the Exchange Prerequisite from the help of my blog here.
Install the Exchange 2013 SP1 Edge Transport Server.
a. Run the setup.exe. Select “Don’t check for updates right now”
b. Now you will see, setup is coping the files to start the setup.
d. Accept the agreement and click next here.
f. In the server Role selection, make sure you select Edge Transport Role and click next.
h. It will do a readiness check.
i. Once Readiness check completes without an error then click install.
j. Once finish, restart the server.
k. Let us do some checks. Setup.log
Check the Server Component
Check the transport Agents
Check the receive connector
Export Edge Subscription from EDGE Transport Server
Run the below command to export the subscription then copy the file to Mailbox server.
New-EdgeSubscription –FileName “FilepathFilename.xml”
Look at the screen, it clearly says Edge will talk to Mailbox server. We need to import this file within 1440 minutes (24 hours) else subscription will expire.
Type Y then Enter at the confirmation Prompt.
Create a host record in the DNS if there is not one present. Then test the ping from EDGE to Mailbox and Mailbox to EDGE. Do not proceed until this works.
Import Edge Subscription on a mailbox Server
Check this when you run Get-help New-EdgeSubscription
Run the below command to import the subscription.
New-EdgeSubscription -FileData ([byte]$(Get-Content -Path “ FilepathFilename.xml” -Encoding Byte -ReadCount 0)) -Site “ADSiteName”
Ensure that you have port 50636 open from mailbox LAN to Edge Transport DMZ.
Verify the Changes in Exchange Admin Center in ECP
No other send connector required.
There is no new receive connector required.
Don’t change Send connector Configuration
“–” is part of the configuration on the “EdgeSync – Inbound to AD Site” Connector so don’t change it. We will see this in the smart host and accepted domain
The — value in the address space represents all authoritative and internal relay accepted domains for the Exchange organization.
The — value in the list of smart hosts represents all Mailbox servers in the subscribed Active Directory site.
Configure Internal SMTP server on Transport Configuration
Use the InternalSMTPServers parameter on the Set-TransportConfig cmdlet to specify a list of internal SMTP server IP addresses or IP address ranges to be ignored by the Sender ID and Connection Filtering agents on the Edge Transport server.
Run the below command on the mailbox server
Set-TransportConfig –InternalSMTPServers IP, IP
Configure Port 2525 if CAS and MBX are installed on the same server
Run the below command
Set-SendConnector “EdgeSync – Inbound to Default-First*” -Port 2525
Or Change from ADSIEDIT
Start Edge Sync
Once all above completed, run the below command
Start-EdgeSynchronization -Server MailboxserverFQDN -TargetServer EDGEServerFQDN -ForceFullSync
Restart Edge-Sync on the Edge Transport Server.
Test the Mailflow:
Incoming from EDGE to Exchange ORG
My LAB is not receiving from Internet so I used the telnet. This is also showing the Exchange verbs.
Message Receive – See header
From Exchange ORG to Internet
See the Message Header
Edge Transport Server: http://technet.microsoft.com/en-us/library/bb124701(v=exchg.150).aspx
Message Tracking Verbs: http://technet.microsoft.com/en-us/library/bb124375(v=exchg.150).aspx
Microsoft MVP | Exchange Server