In working with a customer, their design uses a pair of C690 ESA appliances with an interface for the DMZ and one internally in a global pool. They only would like external bound email to be masqueraded and all other internal domains will be routed back to internally without being masqueraded. Since the masquerading appears to be tied to the listener IP, all inbound messages to the Ironport that will need to be routed back internally will become masqueraded. My only thought would be to have the traffic re-routed back to the internet edge IP to make the final decision and masquerade. Please let me know if there are other creative approaches to accomplishing this ask. Thanks!
