Cloud **bleep** security

[M_alamin]

Hi , we are planning to move from on premises proof point to Cisco Cloud **bleep** and have below inquiries need to be answered please:

. We have two domain lets say domain one is abc.com and domain two is xy.abc.com can we have both donain configured under RAT to accept inbound emails?

. Do we need to have exchange hub or load blanching to be natted on the internet then configur ESA to point to the puplic ip **bleep** of the natted exchange hub or load balancing for inbound **bleep** for both domain?

. What will be configured on the exchange hub as smart host for outgoing **bleep** , is it the puplic ip of the esa server on the cloud? 

[Ken Stieers]

Yes, you can set both domains in the RAT.
Then configure SMTP Routes to point at your internal Exchange boxes.
Then point both domains MX records at the A records that Cisco gives you for your cloud ESAs.

Yes, I would NAT the exchange transport box(es) or load balanced IP to the internet, and then set the firewall rules such that only your ESA's can talk to it. This NAT'd IP is what goes in your SMTP routes in the ESA.

I'm not sure because I'm not in the cloud, but presumably they give you a 'public' and a 'private' ip and/or listener in the cloud ESAs, where 'private' is the one intended for outbound mail...

Did they not assign a migration resource of some kind?