Forum Discussion

jnowlin_44976's avatar
jnowlin_44976
Icon for Nimbostratus rankNimbostratus
Jun 01, 2009

Load Balance SMTP for Exchange 2007 relay

i am needing to load balance the SMTP relay traffic to my exchange 2007 hub transport servers. i can set this up using auto snat but i have discovered the issue that exchange sees the traffic from my internal bigip ip address (and not the clients) and therefore is allowing any relay sent to the Exchange virtual server to relay (not secure).

 

 

preferably i would like the bigip to load balance SMTP and the exchange servers to see the traffic as the client ip addresses for logging and security.

 

 

is there any way to accomplish this without changing the default gateway on the exchange servers?

14 Replies

  • but how many implementations are there that won't require legwork

     

     

    Sorry, I was being thick. Yes, the server would need to be able to parse the custom header instead of the source IP from the TCP packet for any ACL'ing.

     

     

    Aaron
  • Hi guys, I am new to this site, but I am having the same issue with my Exchange 2010 hub transport servers. Did anyone solve it?
  • Posted By hoolio on 01/05/2011 02:20 PM

     

    I think SMTP does support X- like headers like HTTP does though. Here is an example of how to do it using .NET:

     

     

    Just to complete this old thread:

     

     

    X-headers in smtp messages are any non-standard header that the MUA (client, as in Outlook express och Thunderbird) or MTA (mail server, as in MS Exchange, Postfix or sendmail) wishes to add to the e-mail for any reason. Self promotion is not uncommon, neither is information about anti-spam and/or anti-virus precautions taken when receiving the message.

     

     

    But an X-header is only a part of the message body, and the message body is usually not available to the receiving server during the conversation where it's decided if access should be granted or not, so simply put: It can't be used.

     

     

    And second: Since it would be extremely easy to forge such a header they would not be of any practical use to a mail server admin anyway.

     

  • Thanks for the background info. If the SMTP server being load balanced could read the custom header, it could trust what LTM inserts for the client IP LTM receives. As with HTTP, you'd probably want LTM to remove any pre-existing instances of that header though to ensure malicious clients couldn't inject their own value. However, as Jason pointed out, all of this is a nice academic discussion if the server can't do anything with the header value.

     

     

    Aaron