Messaging Gateway

 View Only

  • 1.  install/configuring the SMS 8300 appliance

    Posted Jun 10, 2008 11:22 AM
    I'm installing a SMS 8300 on our network for the first time. We have only 1 Exchange 2003 server, with an IP address of 192.168.102.8 /24. Our firewall has a mapped ip address that passes all traffic from a static public ip address (our public MX record) from/to the private ip address. All ports are open. (probably not safe, but I have Symantec Endpoint Protection and Symantec Mail Security V6 installed on the Exchange server). I need to filter incoming and outgoing mail, but not IM traffic. I would like to maintain this topology, and have mail flow in thru the appliance and then to the Exchange server, without changing any IP addresses. Can I give the appliance 2 private IP addresses and still accomplish this? If so, how? We have our ISP hosting our public MX records, and our internal DNS server hosts the internal MX records' IP address. Should I make the fqdn of the appliance the same as the Exchange server? If not, how do I make mail flow? And what about public and private DNS records? THANKS!!!
    Mike Rydzewski
     


  • 2.  RE: install/configuring the SMS 8300 appliance

    Posted Jun 18, 2008 06:10 PM
    What you need to do is actually pretty simple.

    Keep you external DNS records the same.  They point to your firewall anyway and you're not changing your external IP's.

    In your firewall, change the static NAT rule so that the external MX IP address translates to the IP address of your 8300 appliance.  Ideally, this should allow only SMTP and/or authenticated SMTP (I forgot that port number), but that's another issue.

    In the appliance you will need to tell it to forward LOCAL domain email to the internal IP address of your Exchange server.  Before this, you should also define all of your local domains that it will process email for.

    I would recommend that you have the appliance in a DMZ and only allow the necessary services through your firewall to the Internet (SMTP) and to your Intranet (email, LDAP, SSH, http(s), etc)

    If you have the skills and equipment, set up a DNS server in your DMZ to process realtime blackhole DNS queries for your appliances.  Most lists are free, but some of them request/require payment for commercial access.  And they CAN tell based on volume and will limit access.  It will be money well spent.

    Even though IM filtering is built in, we don't use it, but if your existing systems don't know about the appliance, I don't think you need to worry.  The only problem I would expect is if your external IP for IM is the same for email.  Even then you could just have your firewall forward that port on that IP to your existing IM solution and forward email to the appliance.