Guides / windows-server
EdgeSync: a 24-hour window and a connector nobody removed
The subscription file expires in a day, -FileName and -FileData are not interchangeable, and mail bypassed Edge because of a connector created days before.
An Edge Transport server sits in the perimeter, is not a member of the domain, and cannot read Active Directory. EdgeSync is what gives it the slice of the directory it needs — recipients, accepted domains, connectors — over a one-way replication from inside to outside.
Setting it up is four commands. Three things about it are not obvious, and one of them has a deadline.
The deadline nobody mentions
Running New-EdgeSubscription on the Edge server does three things, and the first one starts a clock.
It creates the ESBRA account — EdgeSync Bootstrap Replication Account, the AD LDS credentials used to authenticate the very first connection. That account is configured to expire 24 hours after creation.
It populates the subscription file with the ESBRA credentials and the public key of the Edge server’s self-signed certificate. The credentials are specific to the server that exported it: this is not a file you can reuse on a second Edge server.
It disables a set of cmdlets. From this point the configuration objects that EdgeSync will replicate are removed from AD LDS, and the cmdlets that modified them stop working locally:
| Disabled on the Edge server after subscription |
|---|
Set-SendConnector · New-SendConnector · Remove-SendConnector |
New-AcceptedDomain · Set-AcceptedDomain · Remove-AcceptedDomain |
New-RemoteDomain · Set-RemoteDomain · Remove-RemoteDomain |
The Get-* cmdlets remain. You can look; you cannot touch.
The two parameters that are not interchangeable
# On the Edge server
New-EdgeSubscription -FileName "C:\EdgeSubscriptionInfo.xml"
# On the internal Exchange server — note: -FileData, not -FileName
$data = [System.IO.File]::ReadAllBytes("C:\EdgeSubscriptionInfo.xml")
New-EdgeSubscription -FileData $data -Site "Default-First-Site-Name"
# Start and verify
Start-EdgeSynchronization
Test-EdgeSynchronizationWhat the import actually does
Worth knowing, because it explains the fault in the next section.
- The subscription is created and the Edge server joins the Exchange organisation; a configuration object appears in Active Directory.
- Every Mailbox server in the site is notified, retrieves the ESBRA account from the file, and encrypts it with the public key of the Edge server’s certificate.
- ESRA accounts are created in Active Directory — one per Edge/Mailbox pair — replacing the bootstrap account for all subsequent synchronisations.
- The inbound and outbound send connectors are created automatically, and every pre-existing send connector on the Edge server is deleted.
- EdgeSync opens a secure LDAP connection and performs the initial replication: topology, configuration, recipients, ESRA credentials.
- The recurring synchronisation schedule is established.
| Connector created automatically | Function |
|---|---|
EdgeSync - Inbound to <site> | Relays messages from Edge into the Exchange organisation |
EdgeSync - <site> to Internet | Relays messages from the organisation out to the internet |
The connector that won on cost
Note step 4 above: subscribing deletes pre-existing connectors on the Edge server. It does not touch connectors on the internal server, which is where this one lived.
The fix was to disable the manual connector — done on the internal server, because after subscription the Edge server cannot be changed locally.
The firewall asymmetry, and why one lesson looked arbitrary
EdgeSync needs three ports open: LDAP 389 for the initial phase, LDAPS 50636 for the encrypted replication, SMTP 25 for the mail itself.
On the internal Exchange server, nothing has to be opened by hand. The installer creates its own firewall rule group, EdgeSync rules included. On the domain controller, which has no Exchange installed, and on the Edge server, isolated in the perimeter, the rules must be added explicitly.
Verification, and a note on scale
Test-EdgeSynchronization returning SyncStatus: Normal, with the lease holder assigned to the internal server and replication credentials and cookies present, means the trust relationship is fully established.
Three things to take away
Generate the subscription file when you are ready to use it. Twenty-four hours sounds generous until the file has to cross a network boundary you are still building.
After subscription, the Edge server is read-only. Every change happens inside and arrives by replication. That is a security property, not an inconvenience.
When a new component appears not to work, inventory the old ones. Nine times out of ten the new thing is fine and something older has precedence — and in a routing system, precedence has a number attached to it.