Cannot Access Mail Service That Is Installed Directly on ISA Server with a DMZ Network Adapter (299959)

SYMPTOMS

Your Internet hosts may not connect to your mail service, indicating that a response was not received from Internet Security and Acceleration (ISA) Server. This issue can occur in the following scenario:

Your Microsoft Windows 2000-based server has three network adapters.
The first network adapter connects to an upstream router to the Internet.
The second network adapter connects to a "demilitarized zone" (DMZ).
The third network adapter connects to the internal LAN.
A mail service that is running on ISA Server is configured to listen for inbound connections on the DMZ network adapter.

CAUSE

This issue occurs because Internet hosts are attempting to make a connection to the service that is listening on the DMZ network adapter, but ISA Server cannot route packets properly to that adapter. This is caused by the way that ISA Server handles routing to the DMZ adapter.

MORE INFORMATION

To make this scenario work properly, either use the service bound to the external adapter, or run the service on a server behind the DMZ.

To configure routing to a server on the DMZ, follow these steps:

In ISA Management, under Access Policy, right-click IP Packet Filters, and then click Properties. Select the Enable packet filtering and Enable IP routing check boxes.
Right-click IP Packet Filters, point to New, and then click Filter.
Create a custom packet filter for the port that is needed for the service request.
On the Local Computer tab in the filter, select the This computer (on the perimeter network check box, and then type the IP address of the server behind the DMZ that provides the service.