![\"NewImage\"](\"https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2019\/01\/NewImage.png?resize=652%2C120&ssl=1\" "\\"NewImage.png\\"")
\u00a0<\/p>\nFET == Front End Transport service in Exchange 2013. Is a part of the Client Access Server (CAS) role, it accepts emails. Receives emails, Sends emails. Stateless, no inspection, queueing etc. Just a simple dude!<\/p>\n
Here are the default receive connectors on an Exchange server. 3 belong to FET, 2 to HT (Hub Transport).<\/p>\n
\u00a0<\/p>\n
HubTransport is the Transport service on the Mailbox server role.\u00a0<\/p>\n
Here are the ports these various connectors listen on:<\/p>\n
[PS] C:\\Windows\\system32>Get-ReceiveConnector\r\n\r\nIdentity Bindings Enabled\r\n-------- -------- -------\r\nRAK1EXCH01\\Default RAK1EXCH01 {0.0.0.0:2525, [::]:2525} True\r\nRAK1EXCH01\\Client Proxy RAK1EXCH01 {[::]:465, 0.0.0.0:465} True\r\nRAK1EXCH01\\Default Frontend RAK1EXCH01 {[::]:25, 0.0.0.0:25} True\r\nRAK1EXCH01\\Outbound Proxy Frontend RAK1EX... {[::]:717, 0.0.0.0:717} True\r\nRAK1EXCH01\\Client Frontend RAK1EXCH01 {[::]:587, 0.0.0.0:587} True<\/pre>\nThese connectors are stored in AD under the configuration partition.\u00a0<\/p>\n
![\"Screen](\"https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2019\/01\/Screen-Shot-2019-01-01-at-1.37.27-PM-1.png?resize=660%2C323&ssl=1\" "\\"Screen")
<\/p>\n
FET listens on various ports:<\/p>\n
NT AUTHORITY\\ANONYMOUS LOGON<\/code> to accept any recipient when sending emails. (An alternate way detailed in the same article<\/a> is to set the receive connector as Externally secured). I didn\u2019t know the receive connectors were AD objects and you could assign ACLs to it so was pleased to learn that today. :)<\/li>\n<\/ul>\n<\/li>\n- \u00a0Port 587 – for receiving emails from clients (such as IMAP4 & POP3 clients that expect an SMTP server where they can submit emails to). The receive connector for this is called Client Frontend <servername><\/strong>. This port does not accept anonymous connections, clients have to authenticate.\n
\n- To clarify for myself because I have forgotten this from my past: port 465 is for mail submission where a TLS handshake begins immediately<\/em>\u00a0(implicit TLS) while port 587 is where TLS starts only after the clients sends a
STARTTLS<\/code> verb. What this means for Exchange is that port 587 can accept TLS connections but chances are you will get a certificate error when trying to use TLS. You must therefore assign a certificate to this receive connector<\/a> if you want TLS. Thanks to RFC 8314<\/a> for reminding me of port 465 vs 587 and this FastMail page<\/a> for some history.\u00a0<\/li>\n<\/ul>\n<\/li>\n- Port 717 – for receiving emails from the mailbox server role. The receive connector for this is called Outbound Proxy Frontend <servername><\/strong>. This is only used it a send connector has the \u201cproxy through client access server\u201d ticked. If this option is not ticked the Mailbox server can send external emails directly to external SMTP hosts. (Reason for doing this is that then all outgoing emails appears to come from the CAS server rather than the Mailbox Server – better from a security point of view as the CAS is what is usually Internet exposed).\u00a0\n
\n- (Update, as a reminder to myself). Typical outgoing mail flow is that Transport service on Mailbox sends to Edge server directly<\/a>. Unless I tick the option as mentioned above. Incoming is Edge Transport to FET to Transport on Mailbox.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
As you can see the FET is for emails from other servers or SMTP clients. It is not used when someone sends an email via Outlook MAPI for instance. This picture from the Microsoft docs<\/a> on the Exchange 2013 mail flow is worth putting here for future reference. As you can see, when Outlook MAPI is used to send an email it is stored in the mailbox database and the Mailbox Transport service picks it from there. Outlook doesn\u2019t send an email via SMTP to Exchange.\u00a0<\/p>\n![\"NewImage\"](\"https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2019\/01\/NewImage-1.png?resize=660%2C601&ssl=1\" "\\"NewImage.png\\"")
<\/p>\n
The Mailbox server has two<\/strong> \u201cmail flow\u201d services running on it.\u00a0<\/p>\n\n- The first of these is what we saw as HubTransport in the screenshots above. This is known as the Transport service in Exchange 2013 (though confusingly referred to by its Exchange 2010 name of Hub Transport in the GUI!) and is a stateful SMTP server – i.e. does things like categorizing etc. as in the immediate screenshot above.<\/li>\n
- The second of these in the Mailbox Transport service (which in turn can be thought of as two components but I am going to ignore that here) and this one\u2019s stateless like the FET. Its role is to take mail from the mailbox database and\/ or inject mail into the mailbox database. It also interfaces with the Transport service to send & receive emails.\u00a0<\/li>\n<\/ul>\n
At this point it\u2019s worth pointing to this older post<\/a> of mine with some screenshots of these components to get a better picture of the components and flow. One more screenshot I\u2019d like to add here is this one from the Mastering Exchange 2013 book<\/a>.<\/p>\n![\"NewImage\"](\"https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2019\/01\/NewImage-2.png?resize=660%2C532&ssl=1\" "\\"NewImage.png\\"")
<\/p>\n
The Transport service (aka HubTransport) on the Mailbox server is pretty important (not that Mailbox Transport service is any less important).\u00a0The Transport service does content inspection etc<\/a>\u00a0and\u00a0has two connectors of its own. It listens on these ports:<\/p>\n\n- Port 2525 (if the Mailbox & CAS roles are on the same server – in this case CAS has already taken port 25 for itself) or Port 25 (if the Mailbox & CAS are on separate servers) – for many things<\/em> (read on). The receive connector for this is called Default <servername><\/strong>.\u00a0\n
\n- This port is used to receive emails from the FET for internal mailboxes, from the Transport service of other Mailbox servers, and from the Mailbox Transport service on itself or other servers.<\/li>\n
- Looking at the diagram from earlier (repeated below), the three incoming arrows are what it accepts emails from. \u00a0The yellow \u201cSMTP Receive\u201d is the Transport listening on port 2525 or 25. It accepts emails from the FET (arrow from top), the Transport or Mailbox Transport of other servers (arrow from left), and Mailbox Transport from itself (arrow from down).\u00a0<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
![\"Screen](\"https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2019\/01\/Screen-Shot-2019-01-01-at-5.40.07-PM.png?resize=371%2C489&ssl=1\" "\\"Screen")
<\/p>\n
\n- Port 465 – this is used to proxy client<\/span>\u00a0connections (IMAP4 & POP3 email clients) to port 587 of the FET. The receive connector for this is called Client Proxy <servername><\/strong>.<\/li>\n<\/ul>\n
To summarize, the important receive connectors to keep in mind for a typical Outlook\/ Exchange environment are the 1) FET receive connector on port 25, the 2) HubTransport receive connector on port 2525 or 25. If you have IMAP4 & POP3 clients then the 3) FET receive connector on port 587 and 4) HubTransport receive connector on port 465 to matter. And lastly, if you proxy outbound connections via the CAS then the 5) outbound proxy connector on port 717 also matters.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
FET == Front End Transport service in Exchange 2013. Is a part of the Client Access Server (CAS) role, it accepts emails. Receives emails, Sends emails. Stateless, no inspection, queueing etc. Just a simple dude! Here are the default receive connectors on an Exchange server. 3 belong to FET, 2 to HT (Hub Transport). \u00a0 … Continue reading FET ports<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[86],"tags":[],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/4390"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=4390"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/4390\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=4390"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=4390"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=4390"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}