[FW1] [FW-1] Ideal Esafe config

[Chuck Melanson <chuck@FW1-NOSPAMmelancorp.com>]

Hello All,

I have a customer site that has a very messy esafe configuration and I'm
looking for anyone's ideal config so that I can at least recommend some
kind of solution for them.

Their current conf:

  external world
	  |
	  |	DMZ
	FW-1 -------------- Mail Relay & ESAFE Scanner
	  |
	  |	Internal LAN
	---------------------|
				Exchange

This is the incoming mail pattern I'm seeing:

1) External mail hits FW external interface (CVP rule & Static NAT)
2) FW sends to eSafe
3) eSafe sends it back to FW
4) FW sends it to the mail relay
5) Relay sends it to exchange
6) FW intercepts and sends back to eSafe
7) esafe sends back to FW
8) FW sends it to exchange

What I'm noticing is that all external mail bounces with looping errors
- back and forth between the fw and esafe.

I'm recommending that:
1) The mail relay be separate from the esafe machine
2) Specific rules be put in for incoming and outgoing mail to be scanned
(right now everything is scanned)

Anyone have any other suggestions?

Chuck.


================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================