Logic thinking to solve a problem that occurred on unfamiliar system

Logic thinking to solve a problem that occurred on unfamiliar system.

     I have a chance to migrate a customer’s firewall in Brisbane, Australia. The customer also need to change his service provider at the same time. To change their service provider, it means their public ip address will be changed as well. This task was belong to the third-party which we had to work with them, to wait them finish their job and then we go on migrate the firewall. After, we finished with the migration. We tested the system. Did the VPN over there working? Can they travel through the VPN tunnel to connect their HQ? Was the tunnel stable enough?  Did the Failover working? Did their DNS also functional? And so on.

     Everything were seems alright but there was one problem exist. It was user’s E-mail system. Please share me your way of thinking to solve this problem. I have presentiment that it was certainly the changed public IP address. By the way, we need to make it clearer and prove until we have an evidence of the root-cause.

     Firstly, we need to be sure that it was not caused by the firewall (to cut off our big variable and to protect our product). I plugged my laptop directly to the WAN. Had been borrowed the user E-mail account and tested it. It was not work as well. So, it was ensuring me to believe my first assumption that the problem was the new public IP address.

How someone like me who have never been implemented Mail server before will get the evidence of this issue.  

Firstly, I queried the system mail server name from a general command that you could try it as well

     Using ‘nslookup’. I also recommend you to choose the right name server of your system and then query the mail exchange system name by ‘q=mx’ command

It was my merit to keep the customer secret of information even I have left this job for quite a while. The user’s mail application was office365. So, you will know automatically by yourself that we will pick up the last result, the xxx-com-au.mail.protection.outlook.com

     I remoted to the server using the popular port number for mail, the 25 of SMTP (simple mail transfer protocol) and it was success. 

   (Trying to connect the mail server on port 25)

                  

(The remote connection was success)

The system was very welcome me (from the above image) that It was start to confusing me as well. It contradicted my assumption. Even it welcome me warmly, it didn’t make me happy.

How a networking guy like me can go further to get any evidence? We are on the beyond of OSL Layer 4 and it was working well and users will be terribly angry if they cannot use their mailbox even they can use their mobile phone to send and receive their working mail.

I was quickly searching from the internet, how a pity one can do anything further with the connected mail server and I found it. It was ‘EHLO’ (Extended Hello). I read the command and try to do something on it. 

(Using EHLO to prove further)

I used my customer mail address as the sender and my E-mail address (with the domain .co.th and gmail.com) as the receiver and Bang! The result was on the red line. It states here. 

550 5.7.1 Service unavailable; Client host [203.201.X.X] blocked using FBLW15

; To request removal from this list please forward this message to delist@messaging.microsoft.com

The Public IP address was just changed not as long as one hour had been blocked from the Microsoft mail exchange service. That was prove my assumption!

I have to hide my customer public IP address too. As you may have already seen it was written as 203.201.X.X, if you want to guess it, the opportunity that you may guess it correctly would be one devide by the two octets of 32-bit system address (IPv4) which is 1 devided by 2¹⁶    

So, the problem was the Public address had been blocked by Microsoft system which match with my first assumption. You can pick my step to explain you customer when you found a problem like this. This may caused by the new Public IP address was not used for a long time and Microsoft didn’t recognize it. Just send your message to ‘delist@messaging.microsoft.com’ to ask them to allowing you IP address. The process will finish no longer than one week. Then, you mail system will working properly.

That was how fun when you are working in a System integration business. I’ve found many types of problem and many many ways to solving them. Unfortunately, most of the times when you face some problem that you have to quickly solve it (Because you have to bring the system up as soon as possible to make the downtime to be the least as you can). So, you will not be able to capture any screen to share someone. I will looking more in my hard disk. Maybe, I could found something like this and to share you next time.

Well, Thank you for reading until the end. I'm not only fond of writing but also love to read. If you have something similar or a better solution, Please share it to me by writing down on the comment or send us an Email directly. Many Thanks!