Now this depends, as each organization has different views and regulatory guidance based on the size and complexity of your environment. Much of this is in the first few planning phases of the admin guide of the ESA. It also depends on other objectives you wish to achieve. In this response I'm assuming basic layout, with the limited information you provided.
The ESA can be configured in a few different ways, think of the ESA as the firewall for your e-mail, and you can use an edge configuration. The benefits of this configuration is it simplifies configuration of the firewall, and better lays out how logically the ESA Ironport works for troubleshooting.
<Management Interface Optional> management network
<Interface 1> DMZ <limit incoming to ICMP/SMTP> <outgoing ICMP/DNS/SMPT>
<Interface 2> LAN <Limit to HTTP/HTTPS/SSH/LDAP/SMTP>
Some organizations do not like having edge servers on their network and do not want to implement a second DMZ. So they wish to keep it all on the DMZ. This is possible, but will require configuring a different port for SMTP such as 26 for your outgoing e-mail. This is so you can assign your outgoing listener to this port and leave the incoming port for SMTP 25 for the incoming e-mail.
<Interface 1> DMZ - rules are a little more intense as you will need to allow access for management and everything through this.
Now if you want to get into additional features:
- AMP
- AV Sophos/McAfee
- SPAM Filter Settings
- Content Filter
- Message Filter
- Outbreak
- SPF/DKIM/DMARC
- TLS/Email Encryption CRES
and so on....
Each of these features can take a lot of time to explain. I know Robert has a document he has been trying to share with us that has all the best settings to tweak.
