In versions of Exchange 2000 that are earlier than Exchange 2000 Service Pack 1 (SP1), Instant Messaging did not support proxy servers between Instant Messaging clients and their home servers or between Instant Messaging clients and other Instant Messaging clients that log on from outside a network that is secured by a firewall.
When UserA adds UserB to his or her contact list, UserB's Instant Messaging home server is responsible for sending UserA notifications when UserB's status changes. This is done by the Instant Messaging home server opening a new connection to the client by using a port that is higher than or equal to 1024. If a firewall exists between the client and the Instant Messaging home server, the server cannot open a connection to the client, and the client never receives the status change.
When an Instant Messaging client subscribes to a resource, the client provides a callback header that contains the URL for the resource that receives the callback. For example, a client may provide a callback that looks similar to http://192.168.1.17:1234. The server makes a notification request to this URL:port combination. The notification request opens a new connection to the client. These notification requests are delivered through NOTIFY requests.
Instant Messaging contacts who log on to the Instant Messaging Service through a proxy server or by using network address translation (NAT) can send instant messages to other contacts, but may not be able to receive instant messages. Other Instant Messaging contacts who respond to instant messages from these "external" Instant Messaging contacts receive the following error message in the Instant Messaging window:
The following message could not be delivered to all recipients:
In addition to the error message that is generated in the Instant Messaging window of the Instant Messaging contact, the following error message is logged in the Internet Information Service (IIS) protocol log of the server that is running the Instant Messaging Service:
NOTIFY /instmsg/aliases/<alias> - 500
This behavior may occur if the Instant Messaging Service cannot communicate with an Instant Messaging contact who logs on to the Instant Messaging Service through a proxy server or by using NAT. When an Instant Messaging contact logs on by using one of these methods, the Instant Messaging client registers the client's local area network (LAN) Internet Protocol (IP) address and a dynamic Transmission Control Protocol (TCP) port that is higher than 1024. Generally, these IP addresses are either not routable or not resolvable. Therefore, the Instant Messaging Service cannot deliver the message.
Additionally, authentication can only occur if the client can connect directly to the remote Instant Messaging home server instead of the Instant Messaging router. Client authentication between an Instant Messaging router and a home server translates some of the IP address information in such a way that authentication does not occur. If a client tries to authenticate to a home server that is behind a firewall, port 80 is typically open, and traffic is permitted through. However, when the client registers its IP address and port information to a port that is higher than 1024, the server must be able to connect to that client using those addresses. Because most firewalls do not have all ports that are higher than 1024 open, this functionality is lost.
Before the release of Exchange 2000 SP1, remote users could access the network through Remote Access Service (RAS) or Point-to-Point Tunneling Protocol (PPTP). However, Exchange 2000 SP1 and later includes a new feature for Instant Messaging named "Polling." Additionally, the MSN Messenger Service 3.5 for the Exchange 2000 Instant Messaging client introduced support for fixed ports. This article describes these new features.