Routerman thanks for the help, another question

[rkmorrow]

Routerman,

I appreciate the help you have given me, you sound very knowledgable.

I have another question.

1. Don't I need to have POP3 connectivity to the exchange box so the internal people can retrieve their mail when they are at home?

I can make connectivity to the exchange server from the outside interface on the firewall, so that is a good sign.

2. All I need now is to have an outside DNS create an MX entry for our selected domain name pointing to the outside interface of the firewall?

3. Is there an issue with domain name conflicting with the internal exchange box name? Can I name it anything I want?

4. Also, I should have a reverse lookup also?

Thanks for all of your help,

rkmorrow

 

[routerman]

Glad to have been of help, and I'll answer the following as best I can.

>1. Don't I need to have POP3 connectivity to the exchange box so the internal people can retrieve their mail when they are at home?

Ok, so thats the reason. The networks I work on provide this type of access in a different manner. The home based users connect via some form of secure dial in or secure VPN, and then access their email as though they are directly LAN connected. This way the minimum amount of services are exposed to the outside. I'm not really so sure about the security aspects of exposing POP3 connections, although agree that it should work as you require.

>2. All I need now is to have an outside DNS create an MX entry for our selected domain name pointing to the outside interface of the firewall?

Yes thats correct, your ISP should be able to sort that out for you.

>3. Is there an issue with domain name conflicting with the internal exchange box name? Can I name it anything I want?

Not so sure about this one, external smtp connects using the DNS resolved IP address, so name isnt an issue here. As far as I'm aware the internal email server uses the IP address to connect to the DMZ server as well, in which case a name isnt a problem either. Thats something that needs checking.

>4. Also, I should have a reverse lookup also?

I dont think there's an advantage to using this here, I'm assuming you mean to verify who is connecting to your smtp server? I'm not really sure if there is a good reason to apply this or not.