Exchange, DMZ, SMTP relay questions

[rkmorrow]

I have several best practice questions that maybe someone could help me with.

This is all in the initial stages of setup.

We have a PIX firewall IOS version 4.4, set up for our protection to the inside.
We have an Exchange server on the inside that has never been set up for outside mail. The exchange server works locally and has ICS working on it, I have sent mail to outside accounts using this as the SMTP server.
Right now, there is a hole punched straight through (inside to outside)the Firewall that allows POP3 connectivity.

There is a DMZ that has a 2k server on it that I would like to use as a SMTP relay to the exchange box on the inside.

My concerns are:
1.If the firewall has a statically mapped address from outside to inside, how do I set up the outside to DMZ rules for the relay box? The same address is used for the holes for 25 and 110 ports. I don't think the pix will let me statically map the same address (outside) to DMZ and inside
addresses.

2.Is normal practice to have POP3 connectivity go straight through or should that be relayed also?

3.Does the relay service work for just outside to inside, or do the internal people relay through the DMZ also?

Thanks for any help anyone can give,
rkmorrow

 

[routerman]

This should'nt be too bad to set up.

>1.If the firewall has a statically mapped address from outside to inside, how do I set up the outside to DMZ rules for the relay box? The same address is used for the holes for 25 and 110 ports. I don't think the pix will let me statically map the same address (outside) to DMZ and inside
addresses.

You need to allocate an IP subnet to te DMZ, using private address space. then alter the static conduit to point the outside IP address to the ip address of the mail server on the DMZ. Your correct in that you cannot use the same IP addresses on the inside and the DMZ.
The exchange server on the DMZ then needs to be configured to connect to the server on the inside network. Also you'll need to set up a conduit from the DMZ to the inside.

>2.Is normal practice to have POP3 connectivity go straight through or should that be relayed also?

In my experience I have never setup a PIX to allow POP3 through from outside, just use SMTP. You may have a particular reason for needing this?


>3.Does the relay service work for just outside to inside, or do the internal people relay through the DMZ also?

Inside to outside relay, can either go straight out as the server can use DNS to look up who its delivering to, or you could relay via the DMZ if you need some additional processing on the outgoing mail. Some customers I deal with scan outgoing email for virus or porn checking, like all things it it `it depends on what you want to do'!!