ESA Deployment without public IP address

[kachavda]

Hello Experts,

I want to know that if I deploy the ESA into my network without public IP address with a config on the ASA as if is there any traffic for port 25 then forwards it to the ESA then to the Exchange.

I have published my firewall's public IP address in the MX record.

In this scenario, will there be any issue for the ESA to determine sender's reputation while receiving an email?

And if the ESA is not able to determine sender's reputation then what is the best way to deploy the ESA without using a public IP address.

[Mathew Huynh]

Hello Kachavda,

On the ESA it does not require a public IP interface.

But when connection comes from internet -> ASA -> ESA -> Exchange

When ASA -> ESA, is the ASA going to mask the original source IP with it's own?

If this is the case, it will break SBRS filtering and the recommended settings if this is the case is to run an incoming relay setup so we can look for the original source IP within email headers.

Regards,

matthew

[kachavda]

Hi Mathew,

Thank you for your reply. ASA is not going to mask source IP with its own.

[Karsten Iwen · Accepted solution]

I would expect that 99% of ESA-installations are using a private IP on the public listener with static NAT on the firewall in front of the ESA. There is nothing wrong on this. Just think about what get's translated here. It's the destination IP of the request that comes from the internet and the ESA still sees the IP of the sender. Only your internal Mailserver doesn't see the original sender-IP. But that typically doesn't matter as the SPAM-check is already done when the mail hits the internal server.

[kachavda]

Thanks Karsten for helping.