You don't have to create another listener. I always go with 2... one public that's nat'd out to the internet, one private that Exchange talks to. Also helps keep flow straight in my head.
If your case you really only need change your SMTP routes to send everything for your internal domains to the TrendMicro box, make sure the Trend box allows the ESA to send mail through it, and then allow the TrendMicro box to talk to exchange. Also make sure the filters on the Trend box aren't checking SPF/DKIM/DMARC as that's going to be wrong since the mail from outside now looks like its coming from your ESA, not the actual sender.
Exchange out to Ironport and from there to external parties doesn't have to change at all.
________________________________
This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited.
If you have received this communication in error, please immediately notify us by telephone and return the original message to us at the listed email address.
Thank You.
