RE: Exchange Questions

[sean.kelly () lanston com]

> I assume by DMZ you will have a third or fourth interface on FW1?
>
> I prefer this since this will prevent inbound connections to internal
> hosts. This is what I do for Lotus Notes, Exchange etc. Also, 
> I'll setup
> the hosts on the third and fourth interfaces with real (untranslated)
> address. Then all the hosts on the internal interface have translated
> addresses.

I can see the paranoia benefit of setting up an exchange/smtp server outside
the firewall and using it to forward mail to an internal address -- you
could make the packet forwarding rules tighter -- but I can't imagine
wanting my only exchange server to be there.  Having an internal email
server just sitting on the net doesn't seem like a good idea to me.

Sean