After deciding to use my FTMG server for Spam Protection using the Microsoft Exchange Edge Transport syncronisation I proceeded to follow the configuration guides on Technet.
Everything seemed to be working excellently, SPAM was reduced considerably. Then out of nowhere a number of people contacted me to say that they were receiving Non Deliverable Reports when trying to send me emails. The content of the NDR was:
#< #5.7.1 SMTP; 550 5.7.1 External client with IP address w.x.y.z does not have permissions to submit to this server. Visit http://support.microsoft.com/kb/928123 for more information.> #SMTP#
I thought this was a bit odd because it had been working without issue for nearly a week. Upon investigation I found the Forefront TMG Managed Control Service was not started on my FTMG Server. This service controls the integration of the FTMG E-Mail Policy with the Exchange Edge Transport server. Trying to start the service simply failed with an error of:
Windows Could not Start the “Microsoft ForeFront TMG Managed Control” service on Local Computer
Error 0x80070057 : Parameter is incorrect
I did a bit of searching and found that this could be caused by the IP Block List in the Exchange Management Console filling up with IP addresses. My first thought was why the IP Block List on FTMG was not reflecting this? Maybe that’s one for the FTMG Product Team.
I opened the Exchange Management Console and checked the IP Block List, which was enabled, to see what was listed. This didn’t go so well. I received the following error message:
Obviously this was not good! I couldn’t control Exchange through the FTMG Console (which is where all configuration changes are supposed to be made. But worse, I couldn’t control it through the Exchange Management Console either.
Last resort, I tried the Exchange Management Shell. Running the following command: Get-IPBlockListEntry provided me with a list of over 100 IP addresses that had been blocked. Excellent, at least I now knew I could do something via the EMS. Running Get-IPBlockListEntry | Remove-IPBlockListEntry removed all the IP Addresses. I was then able to start the Forefront TMG Managed Control Service.
First thing I did was disable the IP Block List – using the FTMG console of course! My server has now been running happily for nearly 24 hours again.
This kind of begs the question as to how and why the IP Block List on the Edge Transport server is filling up with IP addresses, and I guess more importantly, why the same IP Block List in FTMG does not reflect the contents of the Edge Transport Server?
Demazter's Blog 