Figure 83 Distributed Two Tier EMail Design

inemnl Mini

Servers

IMUji .

Anijiiirus Mail Softfo-s (SMTP)

[View full size image]

Exiernnl SMTP StKvClS

Anijiiirus Mail Softfo-s (SMTP)

Exiernnl SMTP StKvClS

Oulsidc SMTP Scrvçi

Oulsidc SMTP Scrvçi

The firewall access control policies to implement this design are as follows. Only the mail-related portions of the access control list (ACL) are shown. Bogon and ingress filtering are excluded for clarity. Stateful filtering is assumed, so the return traffic in a conversation is implicitly permitted.

Inbound on the inside interface:

IPermit the AV layer to send traffic to the external servers using SMTP access-list 101 permit tcp host 10.8.8.5 host 192.0.2.50 eq 25 access-list 101 permit tcp host 10.8.8.5 host 192.0.2.51 eq 25 access-list 101 permit tcp host 10.8.8.6 host 192.0.2.50 eq 25 access-list 101 permit tcp host 10.8.8.6 host 192.0.2.51 eq 25 IDeny all other SMTP traffic from the internal network, outbound access-list 101 deny tcp any any eq 25

Inbound on the outside interface:

IPermit outside mail servers to send messages via SMTP, only when Italking to the external mail servers. access-list 102 permit tcp any host 192.0.2.50 eq 25 access-list 102 permit tcp any host 192.0.2.51 eq 25 access-list 102 deny tcp any any eq 25

Inbound on the public services interface:

IPermit external mail servers to relay messages to the AV layer. access-list 103 permit tcp host 192.0.2.50 host 10.8.8.5 eq 25 access-list 103 permit tcp host 192.0.2.50 host 10.8.8.6 eq 25 access-list 103 permit tcp host 192.0.2.51 host 10.8.8.5 eq 25 access-list 103 permit tcp host 192.0.2.51 host 10.8.8.6 eq 25

IPrevent external mail servers from relaying mail to any other internal system. access-list 103 deny tcp any 10.8.8.0 0.0.0.255 eq 25

lAllow external mail servers to send messages to outside mail servers. access-list 103 permit tcp host 192.0.2.50 any eq 25 access-list 103 permit tcp host 192.0.2.51 any eq 25 IDeny all other SMTP

access-list 103 deny tcp any any eq 25

100 SEO Tips

100 SEO Tips

100 SEO Tips EVERY SEO Enthusiast Should Know. This Report 100 SEO Tips will help you to Utilize These Tips to Dominate The Search Engine Today.

Get My Free Ebook


Post a comment