Strange Email Routing Issue.. COMPLEX!

[Luke122]

OK, bear with me while I try to explain the setup before the problem.

I'm working with a friend to solve his email issue, and it's a strange one.

His internet connection enters his business, then is split to two separate routers, each with their own external IP assigned.

One of them is a Cisco, which routes some traffic from his business to their head office in Edmonton (via VPN tunnel), the other is a Linksys which handles all the rest of the outbound internet traffic and also houses a VPN tunnel between both of his stores.

General internet traffic is routed through the Linksys, and anything from his business apps and inventory software is routed through the Cisco.

With me so far? OK, good. The VPN tunnel between the two stores (on the Linksys) works fine, and all machines can be reached at either end from within either store. The VPN tunnel from his store to their Edmonton office also works fine, with data going to the proper place.

Here's where it gets weird.

Using Outlook, he retrieves his email from an offsite mail server. If he sets his gateway to the Cisco, it works, but it is slow as it routes to Edmonton through the VPN, and out through their proxy server. If he sets his gateway to the Linksys, the email server wont allow him to download any emails with attachments, but other emails work fine, and all other internet traffic works.

There is no setting within the Linksys to filter email, and I've even tried turning off all filtering, disabling the VPN between sites, and running traces between his laptop and the server to confirm that it's not a path issue.

Cisco = email works, but slow (plus he pays for throughput on the headoffice network)
Linksys = fast, but messages with attachments cant be retrieved.

I've tried hardcoding the IP entries for the server, setting exceptions on the Linksys, sending test messages out through both routers and checking the headers to compare the paths, etc.

I'm running out of ideas here.. any thoughts anyone?

[Luke122]

*bump*
I'm still researching this one, but I"m hoping to get some other ideas here.. any input from anyone would be appreciated!

[.Maleficus.]

I'm not sure if it matters, but do you know the models of the 2 routers? It may help a little..

[Outlaw]

Don't know a lot but had some issues with network slowness here...Is the PC's NIC set to a different setting then the router it is connected to? (ie. PC-10/100 half duplex, Router-10/100 full duplex). Is there any switches between the router and pc? And when you say he cannot retrieve them, do you mean they just aren't there or are there and just won't open?

Good Luck!

OH! and what about other users, if any, do they experience it or is it just him?

[Luke122]

There's two differences here, that need to be mentioned.

First, the Linksys router is an RV042, but I"m not 100% on the router. Reason is that I'm not allowed to touch the Cisco, head offices orders. Haha.. I'm fine with that since I dont feel like dealing with lawyers and such.

The computer is a laptop, with a hardcoded IP address, and it's running Vista, and Outlook 2007 as a mail client. The owner also uses the laptop at home, so the primary IP is DHCP, secondary is static. If it doesnt get find a DHCP server, it defaults to the hardcoded one. No problem there.

He's the only laptop, the only one who occasionally works wirelessly, and the only one using Outlook.

If the email message has no attachment, it downloads and opens fine. When it has ANY attachment (any size), it will start to download the messages, then hang. If you disconnect, his mail server @ the ISP will lock the account for 15 mins. As a result, he's been using Webmail ONLY for the last few weeks.

If he connects through the Cisco, through a tunnel to head office, and then out their proxy, his email works fine.

It only fails when he's connected to the Linksys router, which goes straight to the ISP and the mail server. This really makes me think Linksys, but with a different router in its place, the mail still fails. Which makes me think Routing issue... but at the ISP.

I wonder if the mail server has different IP's for clients on their network, and for clients outside their network... that could explain it. If it's trying to reach an internal address through an external route, it should give an unable to reach host error.. but instead it works fine unless there's an attachment.

DOH! I'll keep on this.

[nil8]

You mentioned that he gets his email from an outside mail server. It doesn't run through either VPN if set properly correct? It goes out and seeks the mail server through his ISP correct?

If this is the case, make sure he has TNEF enabled. It's the MS-specific file attachment method. It's a real pain in the ass, but it should be turned on by default. Look up TNEF and it will tell you how to enable it.

I know that SMTP has no bearing on incoming messages, but as a general rule with ISP's now I set the SMTP port to 587(SMTP_Auth) instead of default due to ISP's blocking port 25 to help curb spammers.

Is it an IMAP or pop3 server?
I doubt if it would be an exchange server, but there is that possibility.

We need a little more info about how his email account is actually setup.

[Luke122]

Thanks for the reply Nil8, I'll answer your questions here..

You mentioned that he gets his email from an outside mail server. It doesn't run through either VPN if set properly correct? It goes out and seeks the mail server through his ISP correct?

Yes, that is correct.

If this is the case, make sure he has TNEF enabled. It's the MS-specific file attachment method. It's a real pain in the ass, but it should be turned on by default. Look up TNEF and it will tell you how to enable it.

I'll do some further reading on TNEF, and test enabling it, but it since the mail never downloads to the PC, it's just not a problem of not being able to open the attachments. It's actually preventing the message from downloading at all.

I know that SMTP has no bearing on incoming messages, but as a general rule with ISP's now I set the SMTP port to 587(SMTP_Auth) instead of default due to ISP's blocking port 25 to help curb spammers.

Is it an IMAP or pop3 server?
I doubt if it would be an exchange server, but there is that possibility.

It is a POP3 server. I find it particularly strange that it would work through the one connection, but not the other.

[nil8]

Well, the reason for it working on one VPN and not the other is entirely up to their network's firewall.
Most VPN clients are restricted at or near the firewall logically in the network to keep them from accessing things they don't need to access as outside users that are tunneling in.
Sometimes this includes blocking ports, such as 110(pop3), to keep a potential security breach from causing major havok. It's good security policy.
It could also be that the DNS server isn't resolving the name of his email server, but I think you mentioned trying just the IP.

Have you tried no vpn connections & checking email or do they have to stay up and active all the time?

I hate to say this, but it might not be a bad idea to call his email provider.

I'm not in the mindset to logically think about this issue. Let me marinate on it for a day or two and see if anything clicks.

[Luke122]

Well, the reason for it working on one VPN and not the other is entirely up to their network's firewall.
Most VPN clients are restricted at or near the firewall logically in the network to keep them from accessing things they don't need to access as outside users that are tunneling in.

The VPN from the Cisco to Edmonton cannot be disabled, and all outbound traffic through the Cisco router is passed to Edmonton, and out their proxy, and back to the ISP mail server. This one works fine. The Linksys has a VPN tunnel to another Linksys at the other store location, and it only routes info destined to those machines. Everything else is just handed out to the ISP gateway. So mail traffic through the Linksys doesnt touch the VPN at all.

Sometimes this includes blocking ports, such as 110(pop3), to keep a potential security breach from causing major havok. It's good security policy.
It could also be that the DNS server isn't resolving the name of his email server, but I think you mentioned trying just the IP.

I can successfully ping and tracert the mail server from either connection. The only failure is messages with attachments coming through the Linksys router. If we try to pick up email from the Cisco, it works just fine, even though it's passing through a proxy server, then a VPN

Have you tried no vpn connections & checking email or do they have to stay up and active all the time?

The Edmonton VPN has to stay up all the time, and I cant touch that connection anyways. The Linksys vpn tunnel can be taken offline, and I did do that to test already.. no difference.

I hate to say this, but it might not be a bad idea to call his email provider.

ISP already denied responsibility, as it works through one router and not the other, he claims it's a config issue at my end, and I'm inclined to believe it. I just cant seem to locate it!

I'm not in the mindset to logically think about this issue. Let me marinate on it for a day or two and see if anything clicks.

[Luke122]

I hope this makes sense.

-Luke