Cisco Secure Email Gateway (IronPort) with Exchange Server: HAT, RAT and SMTP errors

Cisco Secure Email Gateway (formerly Cisco Email Security Appliance, ESA, and still widely called IronPort) describes mail flow in its own terms: listeners, the Host Access Table (HAT), the Recipient Access Table (RAT) and SMTP routes. Most problems between it and Exchange Server come from a mismatch between those settings and Exchange's connectors. This post maps one onto the other, lists the responses you'll see on each side, and shows how to trace a message through both. It covers the appliance and Cisco Secure Email Cloud Gateway with Exchange Server SE and 2019.

Symptoms#

The two 421 texts and the alert are in Cisco's documentation. For the hourly recipient limit, Cisco's guide shows 452 as the code with configurable text; the wording above is what admins commonly report. When the gateway refuses Exchange outright, expect a reject banner as the connection opens or per-recipient rejections; the banner's code and text come from the mail flow policy.

Why it happens#

Each Cisco setting has an Exchange counterpart, and errors appear where the two disagree:

Two more details matter. The address the gateway delivers from isn't necessarily the listener address Exchange sends to; Cisco's own example uses a separate interface to send to internal mail hosts. And recipient validation is the gateway's job, because an Exchange Mailbox server accepts unknown recipients and only then sends the RecipNotFound NDR.

How to fix it#

1. Find out who refused#

Outbound, Exchange quotes the gateway's response in the queue's LastError. Inbound, search the gateway's Message Tracking (or mail logs) for the recipient; Exchange's reply to each delivery attempt is recorded there.

Get-TransportService | Get-Queue | Where-Object { $_.DeliveryType -eq 'SmartHostConnectorDelivery' } |
    Format-List Identity, Status, MessageCount, LastError

2. Fix outbound relay: RELAYLIST and policy limits#

In Mail Policies › HAT Overview, pick the listener Exchange sends to and add each Exchange server's IP, as the gateway sees it after NAT, to the RELAYLIST sender group. Point the send connector at that listener: the private listener in a two-listener design, or the single public listener that smaller models use for both directions.

New-SendConnector -Name "Outbound via Cisco" -AddressSpaces "*" -DNSRoutingEnabled $false `
    -SmartHosts "esa-private.contoso.com" -SourceTransportServers EX01,EX02
Test-NetConnection esa-private.contoso.com -Port 25

For the rate-limiting alert, check Monitor › Rate Limits for the top senders, then adjust Rate Limit for Envelope Senders under Mail Flow Limits in the policy that sender group uses (for example RELAYED), or give that application its own sender group and policy. The 421 timers apply only to public listeners: by default a connection that hasn't injected a message is closed after 5 minutes, and any connection is closed as it nears a 15-minute total limit. Relaying Exchange through a private listener avoids them where your model has one.

3. Fix inbound delivery: SMTP routes and the receive connector#

Under Network › SMTP Routes, each of your domains needs a route to your Exchange servers (or their load balancer). On Exchange, scope a connector to the addresses the gateway delivers from:

New-ReceiveConnector -Name "Inbound from Cisco" -Server EX01 -TransportRole FrontendTransport -Custom `
    -Bindings 0.0.0.0:25 -RemoteIPRanges 10.0.5.20,10.0.5.21 `
    -PermissionGroups AnonymousUsers -AuthMechanism Tls -ProtocolLoggingLevel Verbose
Set-ReceiveConnector "EX01\Inbound from Cisco" -MaxInboundConnectionPerSource 100
Get-AcceptedDomain | Format-Table DomainName, DomainType -AutoSize

Raise the per-source limit if 421 4.3.2 shows up in tracking, or cap the gateway's concurrent deliveries to your domain, and add any RAT domain that's missing from Exchange. Validate recipients with an LDAP Accept query against Active Directory; it can run during the SMTP conversation, so mail for nonexistent users is refused before Exchange creates backscatter. Keep the listener's Add Received Header option on, because Exchange's InternalSMTPServers logic depends on it (see the vendor-neutral gateway checklist).

4. Fix TLS#

When Exchange connects, the gateway presents the certificate selected on the listener (certificates live under Network › Certificates), and each mail flow policy sets TLS on, off or required. On Exchange, a connector with RequireTLS answers a non-TLS delivery with 451 5.7.3, and STARTTLS is offered only with a valid certificate for the connector FQDN (event ID 12014). After TLS hardening, confirm both sides share a protocol version. The gateway also caps concurrent TLS connections across all listeners (100 by default).

Verify the fix#

Get-TransportService | Get-MessageTrackingLog -MessageId "<Message-ID>" -Start (Get-Date).AddHours(-2) |
    Sort-Object Timestamp | Format-Table Timestamp, EventId, Source, ConnectorId, RecipientStatus -AutoSize

• Outbound: a SEND through Outbound via Cisco, an empty smart host queue, and the gateway's Message Tracking showing the message accepted from your Exchange IP.
• Inbound: the gateway shows delivery to Exchange with a 250 reply, Exchange shows RECEIVE then DELIVER, and the receive protocol log shows the session on Inbound from Cisco with STARTTLS.
• Monitor › Rate Limits no longer lists your Exchange senders unexpectedly.

Prevent it next time#

• Change RAT entries, SMTP routes and Exchange accepted domains together.
• When you add Exchange servers, such as new Exchange Server SE servers, add their IPs to RELAYLIST and the send connector before moving mail flow.
• When the gateway gains an interface or cluster member, update RemoteIPRanges, InternalSMTPServers and the firewall together.
• Other gateways: Proofpoint, FortiMail and the rejection codes quick reference.

References#

• Receive connectors in Exchange Server (Microsoft Learn)
• Configuring the Gateway to Receive Email, AsyncOS 16.0.2 user guide (Cisco)
• Troubleshoot Alert Message - System Is Rate Limiting Envelope Sender (Cisco)