Microsoft Exchange Server 2007 : Server and Transport-Level Security - Exchange Server 2007 SMTP Connectors (part 2) - Hub Transport Server Connectors

How Connectors Are Created

As previously mentioned, connectors must exist between all messaging servers for SMTP traffic to be passed. However, inside the Active Directory forest, you do not have to create and configure the connectors between Hub Transport servers. These connections are created implicitly. This means that the connections are created by computing a path between AD sites that is based on Active Directory site link costs.

After you install an Edge Transport server and a Hub Transport server, the Edge Transport server must be subscribed to an Active Directory site by using the Edge Transport subscription process. This process enables the EdgeSync service to establish one-way replication of recipients and configuration details from the AD directory service to the Active Directory Application Mode (ADAM). This subscription process can be accomplished quickly and easily by following the steps listed on the Finalize Deployment tab on the Exchange Management Console. To get to the Finalize Deployment tab, open the Exchange Management Console and click on Microsoft Exchange in the console tree.

When you subscribe the Edge Transpor server, data that is stored in Active Directory gets replicated to the ADAM instance located on the Edge Transport server. Some examples of the data that gets replicated are as follows:

• Configuration of Send and Receive Connectors

• Domains to accept SMTP traffic from

• Remote domains

Connectors can be created using one of the following methods:

• Explicit Active Directory Connector— When an administratator creates a connector in the Exchange organization, an explicit connector is created. This object can be modified by the administrator and changes are replicated throughout the organization.

• Explicit ADAM Connector— When an administrator creates a connector on an Edge Transport server, it is stored in Active Directory Application Mode (ADAM). Connectors that are created on Edge Transport servers are scoped to a single server. An administrator can modify this object; however, the configuration applies only to that particular connector on that Edge Transport server only.

• Implicit— Implicit connectors are automatically computed using Active Directory site link information and existing explicit Active Directory connectors. This connector cannot be modified, and cannot be viewed either in Active Directory or ADAM. The only way to change an implicit connector is to make a change to the system topology. When a change to the topology is made, the connector is recomputed.

• Automatic Explicit ADAM Connector— When you subscribe an Edge Transport server, the EdgeSync subscription process creates an Automatic Explicit ADAM connector inside the Exchange organization. This connector is then replicated to the ADAM instance on the Edge Transport server. This connector cannot be modified on the Edge Transport server, but can be modified in Active Directory. Any changes made in Active Directory are replited to the Edge Transport server during routine synchronization.

• Automatic Implicit ADAM Connector— All implicit connectors are computed from the system topology as described previously. This applies to Automatic Implicit ADAM connectors as well. One or more Edge Transport servers must have access to the information contained in this connector. This connector cannot be modified in Active Directory; however, if a change is made to the system topology, the connector changes resulting from the topology change will be replicated to the Edge Transport server during routine synchronization.

Note

For the Edge Transport servers and the Hub Transport servers to communicate with each other, they must be able to find each other using host resolution in the domain name system (DNS).

Hub Transport Server Connectors

After the Hub Transport server role has been installed on an Exchange Server 2007 server in your environment, you must configure the appropriate Send and Receive Connectors. Until this has been accomplished, the server will be unable to send SMTP messages to, or receive them from, the Internet.

Send Connectors are configured in the Exchange Management Console in the Organization Configuration node, and are stored in AD as a configuration object. The Send Connectors must be configured so that the Hub Tranport server knows what source server to forward the message to. Bear in mind, there can be multiple source servers configured on the connector.

Receive Connectors, on the other hand, are configured in the Exchange Management Console in the Server Configuration node, and are stored in AD as a child object of the server. By default, when a Hub Transport server is brought online, it has two default Receive Connectors already configured.

Both Send and Receive Connectors can be viewed and modified using the Exchange Management Shell. As a matter of fact, many configuration settings can only be accomplished using the Exchange Management Shell.

So, SMTP Send Connectors handle outgoing messages; SMTP Receive Connectors handle incoming messages. For proper message flow, the Hub Transport server must have the appropriate connectors to allow mail flow to and from the Internet (by relaying through an Edge Transport server), as well as to and from other Hub Transport servers.

A Hub Transport server must have at least three required connectors to function properly. The first two, both of which are Receive Connectors, are created automatically during the installation of the Hub Transport server:

• A Receive Connector that is configured to accept SMTP messages on port 25 from all remote IP addresses. The usage type for this connector should be “Internal” as well. This connector is automatically generated during the installation of the Hub Transport server.

• A second Receive Connector that is configured to accept messages on port 587 from all remote IP addresses. This connector is needed to accept SMTP connections from non-MAPI clients who are connecting through a client access server. The usage type for this connector should be set to “Internal.” This connector is automatically created during the installation of the Hub Transport server.

The third required connector is a Send Connector:

• By default, no explicit Send Connector exists on the Hub Transport server, so you must perform one of two actions to create it—either the connector is automatically generated when you create an Edge subscription, or you must manually configure it. After this process has been completed, your environment will be ready to route Internet-bound messages from the Hub Transport server to the Edge Transport server, and then out to the Internet.

Automatic Creation of Send Connectors

To automatically create the Send Connector, you must have a server with the Edge Transport server role and utilize an Edge subscription and the EdgeSync service. To do so, perform the following steps:

1.	Install the Hub Transport server role.
2.	On the Edge Transport server, export the Edge subscription file. If you have more than one Edge Transport server, each server requires a separate subscription file. The Edge subscription file can be exported in the Microsoft Exchange Shell utilizing the following command: new-edgesubscription – filename "c:\server1info.xml"
3.	Next, you must import the Edge subscription. This file can be accomplished using either the Exchange Management Console or the Exchange Management Shell. To do so using the Exchange Management Shell, run the following command on the Hub Transport server: new-edgesubscription –filename "c:\server1info.xml" –site "default-first-site-name"
4.	Verify that synchronization was successful by viewing the Event Viewer application log and inspecting MsExchange EdgeSync events.

Data replicated to ADAM includes the Internet Send Connector. This connector is stored in AD and the settings for it are written on the Edge Transport server in the local ADAM instance. The connector has the Edge Transport server as the source server, and is configured to use DNS MX records to automatically route messages.

Manual Creation of Send Connectors

If you decide not to use an Edge subscription, you must manually create and configure the Send Connector. To do so, follow these steps:

1.	Start the Exchange Management Console on the Hub Transport server.
2.	In the console tree, expand the Organization Configuration node, and then select the Hub Transport node.
3.	In the action pane, click New Send Connector. The New SMTP Send Connector Wizard starts.
4.	On the Introduction page, type a name for the connector, and then select the intended usage from a drop-down box—the intended usage should be set to Internal.
5.	On the Address Space page, click Add, and enter * (all domains) as the address space. Leave the Include All Subdomains check box checked, and click OK. Click Next to continue.
6.	On the Network Settings page, ensure the Route All Mail Through the Following Smart Hosts option button is selected, and then click Add.
7.	Enter the IP address or FQDN for the Edge Transport server, click OK, and then click Next to continue.
8.	On the Smart Host Security Settings page, select the Exchange Server Authentication option button, and then click Next to continue.
9.	Select one or more Hub Transport servers as the source for the connector, and then click Next.
10.	Review the Configuration Summary, and then click New to create the connector.
11.	From the Completion page, click Finish.
12.	Now, you must perform manual configuration of the required connectors on the Edge Transport server. This information is covered in the next section.