[FW-1] SMTP Security Server - General Questions

["Carpenter, Adam" <acarpenter@FW1-NOSPAMSTONEHILL.EDU>]

Title: Message

I just have some quick questions about SMTP & Firwall-1.

 

Right now my mail server is nat'd by the firewall and only SMTP traffic is allowed.  If I wanted to use the SMTP Security Server to scan mail would I be better off:

 

1. Removing NAT address & DNS for mail server & creating an MX record that points all mail to firewall's external interface.  Create an SMTP resource that directs all inbound SMTP to my mailserver & create a rule that allows my mail server to send outbound SMTP.

 

OR

 

2. Leave my MX records & NAT alone and just let Firewall-1 intercept the messages.

 

If I go with #2 is there any reason for the mail server to be publicly accessible anymore?

 

Thanks for the help.

 

- Adam