McAfee Email Gateway version 7.0 Appliances Installation Guide

1Preparing to installDeployment strategies for using the device in a DMZDraft only - 9.13.11Firewall rules specific to Lotus NotesUse this information to identify specific considerations when protecting Lotus Notes systems.By default, Lotus Notes servers communicate over TCP port 1352. The firewall rules typically used tosecure Notes servers in a DMZ allow the following through the firewall:• Inbound SMTP requests (TCP port 25) originating from the Internet and destined for the device• TCP port 1352 requests originating from the Notes gateway and destined for an internal Notes server• TCP port 1352 requests originating from an internal Notes server and destined for the Notes gateway• SMTP requests originating from the device and destined for the InternetAll other SMTP and TCP port 1352 requests are denied.Firewall rules specific to Microsoft ExchangeUse this information to identify specific considerations when protecting Microsoft Exchange systems.A Microsoft Exchange-based mail system requires a significant workaround.When Exchange servers communicate with each other, they send their initial packets using the RPCprotocol (TCP port 135). However, once the initial communication is established, two ports are chosendynamically and used to send all subsequent packets for the remainder of the communication. Youcannot configure a firewall to recognize these dynamically-chosen ports. Therefore, the firewall doesnot pass the packets.The workaround is to modify the registry on each of the Exchange servers communicating across thefirewall to always use the same two “dynamic” ports, then open TCP 135 and these two ports on thefirewall.We mention this workaround to provide a comprehensive explanation, but we do not recommend it.The RPC protocol is widespread on Microsoft networks — opening TCP 135 inbound is a red flag tomost security professionals.If you intend to use this workaround, details can be found in the following Knowledge Base article onthe Microsoft website:http://support.microsoft.com/kb/q176466/Workload managementUse this information to learn about the workload management features of McAfee Email Gateway.The appliances includes its own internal workload management, distributing the scanning load evenlybetween all appliances configured to work together.You do not need to deploy an external load balancer.16 McAfee ® Email Gateway 7.0 Appliances Installation Guide