You can use the same physical interface. It doesn't matter which one. If I'm using just one, I prefer to put 2 IPs on it, one for inbound mail that gets tied to a "public" listener and one for outbound mail that gets tied to a "private" listener. The ip for the public listener gets natted through the firewall to a public IP, DNS records point to that IP, port 25 allowed in, ect... The IP for the private listener is what Exchange's Send Connector has for mail destined for the internet. ... View more

1. What type of certificate should we buy ? Means is there any specific certificate dedicate to such encryption or we just simply ask third party certificate authority about it ? 2. We are using two ESA devices for outbound emails and I believe we require one certificate for each device. Correct me if I am wrong. 3. As there are variety of certificate available at third party CA authority what are the type of certificate is required for ESA TLS encryption? 4.Is there any detailed document/video where I can find the ESA TLS Encryption and end user decryption in as well. 5.In case of emails drops or deliverable, how to trace and restore them?        1. you can buy a standard web server cert, nothing special.  We use our wild card. 2. you want the cert to match the A record that points at the ESA and you want the ESA to use that name on the interface so that's what shows up in the HELO/EHLO response.  Not everyone verifies certs, but you want it to match if they do... which is why we use a wildcard.  3. same question as number 1, same answer  4. Users never have to interact with TLS, there are probably Youtubes around, I don't have links.  I know there are videos around for the encrypted envelope stuff, but I don't have links. 5.  You can set outbound mail that requires encryption to notify the sender if it fails, so your users will have the mail, no recovery required... the ESA doesn't keep it...  If you're dropping mail using some sort of content filter, you can add an action to archive or quarantine the mail before you drop it...    ... View more

There is no license required. You do need to apply at least up to patch 5, each one, in order... If you have Win2016 AD servers you need Patch 6. You can get transparent auth via browsers but that means apps that hit the internet before a browser authenticates the user and/or that dont support authentication will be unauthenticated. You can also use ISE or ISE-PIC, but they incur additional licensing costs. ... View more

Its hitting the DNS servers that the ESA is using... So if you're using split dns for your domain and your ESA is pointed at your internal DNS servers, this will fail unless you set up the records on your internal dns servers too... which makes it hard to really test that its right... Point your ESA's DNS servers at some external DNS servers,(submit/commit) and then test this. ... View more

Track down a domain that won't accept the email. Send mail to it. Look at the tracking log for that mail... My first guess is that your system and their's aren't agreeing on TLS version and/or ciphers to use. Go to System Administration/SSL Configuration and tell us what your SSL config is for Outbound SMTP. ... View more

WCCP, Policy Based Routing or explicit forwarding are your only options to get traffic to the WSA. What firewall are you using? What router are you using? ... View more

That's not what the tap does. The tap lets you send traffic that the WSA gets OUT to another device. That traffic is UNENCRYPTED so that the WSA does decryption and can feed something like a DLP appliance. Taken from the user guide. Web Traffic Tap feature allows you to tap the HTTP and HTTPS web traffic that passes through the appliance and copy it to a Web Security appliance interface in-line with the real time data traffic. You can select the Web Security appliance interface to which the tapped traffic data is sent. If the tapped traffic includes HTTPS data, the appliance decrypts them based on the decryption policies before sending them to the tap interface. See Decryption Policies , on page 216. The selected tap interface must be directly connected to an external security device for analysis, forensics, and archiving. Alternatively, it may be connected to a L2 switch on a dedicated VLAN. ... View more

What version are you running, and are you running AMP? And are you getting all of your alerts? We had an issue related to AMP restarting that would do this. There's also related issues on smaller WSAs when they get their updates. If you have 170s, or V100s, set them to get their updates less often, so you'll run into it less frequently. All of these are better with newer builds later versions of 11.7 and the latest 11.8. ... View more

As far as I can tell, no. But, 13.0, currently in Beta will have single log line output for each email, so a seim will see all of the results of what happened to an email without having to untangle the mail logs. Ken ... View more