McAfee Email Gateway version 7.0 Appliances Installation Guide

1Preparing to installDeployment strategies for using the device in a DMZDraft only - 9.13.11For example, an external mail server can communicate directly with the device, although traffic mightpass through several network servers before reaching the device. The perceived path is from theexternal mail server to the device.ProtocolsTo scan a supported protocol, you must configure your other network servers or client computers toroute that protocol through the device, so that no traffic bypasses the device.Firewall rulesExplicit proxy mode invalidates any firewall rules set up for client access to the Internet. The firewallsees only the IP address information for the device, not the IP addresses of the clients, so the firewallcannot apply its Internet access rules to the clients.Where to place the deviceConfigure the network devices so that traffic needing to be scanned is sent to the device. This is moreimportant than the location of the device.The router must allow all users to connect to the device.The device must be positioned inside your organization, behind a firewall, as shown in Figure 6:Explicit proxy configuration.Typically, the firewall is configured to block traffic that does not come directly from the device. If youare unsure about your network’s topology and how to integrate the device, consult your network expert.Use this configuration if:• The device is operating in explicit proxy mode.• You are using email (SMTP).For this configuration, you must:• Configure the external Domain Name System (DNS) servers or Network Address Translation (NAT)on the firewall so that the external mail server delivers mail to the device, not to the internal mailserver.• Configure the internal mail servers to send email messages to the device. That is, the internal mailservers must use the device as a smart host. Ensure that your client devices can deliver emailmessages to the mail servers within your organization.• Ensure that your firewall rules are updated. The firewall must accept traffic from the device, butmust not accept traffic that comes directly from the client devices. Set up rules to preventunwanted traffic entering your organization.Deployment strategies for using the device in a DMZUse this information to understand about demilitarized zones within your network, and how to usethem to protect your email servers.A demilitarized zone (DMZ) is a network separated by a firewall from all other networks, including theInternet and other internal networks. The typical goal behind the implementation of a DMZ is to lockdown access to servers that provide services to the Internet, such as email.Hackers often gain access to networks by identifying the TCP/UDP ports on which applications arelistening for requests, then exploiting known vulnerabilities in applications. Firewalls dramaticallyreduce the risk of such exploits by controlling access to specific ports on specific servers.14 McAfee ® Email Gateway 7.0 Appliances Installation Guide