Ironport (ESA) interface and listener

 The device has physical interfaces (Data 1/Data 2 and Management). Some devices only Data 1 and Data 2, like C160.

You can create IP interfaces, which are logical interfaces. You can create more than 1 IP interface per physical interface. Something like:

esalab.cisco.com> interfaceconfig

Currently configured interfaces:

1. InternalNet (10.97.14.35/24 on Data 1: esalab.cisco.com)

2. Management (192.168.42.42/24 on Data 2: ironport.example.com)

3. SecondLogicInterface (10.97.14.36/24 on Data 1: esa.cisco.com)

As you can see, I have the IP interfaces named "InternalNet" and "SecondLogicInterface" binded to Data 1 Physical Interface.

Then using one Logic Interface named "InternalNet", I have two listeners (one for inbound other for outbound):

esalab.cisco.com> listenerconfig

Currently configured listeners:

1. IncomingMail (on InternalNet, 10.97.14.35) SMTP TCP Port 25 Public

2. OutgoingMail (on InternalNet, 10.97.14.35) SMTP TCP Port 2525 Private

=============================================

But one thing it is important to note.

You can use one listener only, to do both, inbound and outbound traffic. And that listener will be binded to only one interface.

The important thing here is that the unique listener (configure to use port 25), will need a Sender Group and a Mail Flow Policy to handle outbound traffic.

As you know, each Sender Group requires a Mail Flow Policy. When you create a private listener, the system automatically create the sender group RELAYLIST and a mail flow policy named RELAYED. You will notice that the RELAYED mail flow policy has the connection behavior as Relay.

So, if you want to use one interface, one listener for inbound and outbound, you just need to manually create the sender group and mail flow policy for relaying traffic through your appliance.

Note, make sure the sender group (named RELAYLIST or any other name you want) is the first sender group (from top to bottom), in the HAT (Host Access Table). This is because the system process the HAT from top to bottom, first match wins. It is better to mention that each listener will have a HAT associated with it.

To recap:

Data 1 - IP interface - Listener - port 25 - HAT - Sender Group - Mail Flow Policy

So, if a host connects to your appliance, to the listener you have created for inbound and outbound, the system will look in the HAT for the IP address of that host. Once it finds it in the RELAYLIST sender group, it will apply the mail flow policy RELAYED (or any other name you choose), and then apply the connection behavior, to relay.