The device has physical interfaces (Data 1/Data 2 and Management). Some devices only Data 1 and Data 2, like C160.
You can create IP interfaces, which are logical interfaces. You can create more than 1 IP interface per physical interface. Something like:
esalab.cisco.com> interfaceconfig
Currently configured interfaces:
1. InternalNet (10.97.14.35/24 on Data 1: esalab.cisco.com)
2. Management (192.168.42.42/24 on Data 2: ironport.example.com)
3. SecondLogicInterface (10.97.14.36/24 on Data 1: esa.cisco.com)
As you can see, I have the IP interfaces named "InternalNet" and "SecondLogicInterface" binded to Data 1 Physical Interface.
Then using one Logic Interface named "InternalNet", I have two listeners (one for inbound other for outbound):
esalab.cisco.com> listenerconfig
Currently configured listeners:
1. IncomingMail (on InternalNet, 10.97.14.35) SMTP TCP Port 25 Public
2. OutgoingMail (on InternalNet, 10.97.14.35) SMTP TCP Port 2525 Private
=============================================
But one thing it is important to note.
You can use one listener only, to do both, inbound and outbound traffic. And that listener will be binded to only one interface.
The important thing here is that the unique listener (configure to use port 25), will need a Sender Group and a Mail Flow Policy to handle outbound traffic.
As you know, each Sender Group requires a Mail Flow Policy. When you create a private listener, the system automatically create the sender group RELAYLIST and a mail flow policy named RELAYED. You will notice that the RELAYED mail flow policy has the connection behavior as Relay.
So, if you want to use one interface, one listener for inbound and outbound, you just need to manually create the sender group and mail flow policy for relaying traffic through your appliance.
Note, make sure the sender group (named RELAYLIST or any other name you want) is the first sender group (from top to bottom), in the HAT (Host Access Table). This is because the system process the HAT from top to bottom, first match wins. It is better to mention that each listener will have a HAT associated with it.
To recap:
Data 1 - IP interface - Listener - port 25 - HAT - Sender Group - Mail Flow Policy
So, if a host connects to your appliance, to the listener you have created for inbound and outbound, the system will look in the HAT for the IP address of that host. Once it finds it in the RELAYLIST sender group, it will apply the mail flow policy RELAYED (or any other name you choose), and then apply the connection behavior, to relay.
==========
HAT (Host Access Table) : Define sender groups with SBR (SenderBase Reputation Score)
Listener is a SMTP daemon that accepts incoming connection from SMTP clients on port TCP/25.
A single listener can accept incoming SMTP requests from the Internet and outgoing request from a mail server
We can configure one Public Listener for requests from Internet and another Private Listener for requests from internal mail server
Public Listener needs specify internal domain in RAT (Recipient Access Table ) to accept message delivery, in SMTP Routes specify local mail server
Private Listener needs specify internal mail server IP Relaylist in HAT to allow outgoing message to delivery
Mail Flow Policy defines action on the emails received by ESA, like Accept/Reject, limits, security feature, sender DNS verification etc.
The sender verification feature consists of the following components:
• Verification of the connecting host. This occurs prior to the SMTP conversation., > in Sender group Settings
• Verification of the domain portion of the envelope sender. This occurs during the SMTP conversation. > In Mail Flow Policy settings.
You can use the sender verification exception table to storeSender Verification Exception Table a list of domains or addresses from which mail will be automatically allowed or rejected (see ).
Comments
Post a Comment