Integrating Sophos vSEA with Exchange 2013

Question

Hello Everyone, 
 
 I am planning to deploy SEA for our Mail Security and currently have Exchange 2013 (1x MB/CAS Server and 1x Edge Server). Incoming SMTP is NATed to Edge Server (In/Out) and the Send Connector has Edge as the outgoing mail server. 
 
 It looks simple from the documentation but I am really unable to figure out how actually the things should be in place. I am thinking of below; 
 - NAT SMTP to SEA (In/Out) 
 - Disable the current Send Connector and Create a new one and add SEA as Smart Host and chose the MB/CAS server as i don't see the role of Edge server anymore 
 - Integrated SEA with AD using LDAP 
 - In SEA Configure MB/CAS server under Mail Delivery Serves & Internal Mail Hosts 
 
 Is there anything i am missing ?

lferrara · Accepted Answer

Ismail , 
 some tips: 
 
 Make sure to deploy SEA on your DMZ zone so they can be reached by External SMTP directly 
 Create proper public MX records which point to SEA IP address (public IP) 
 Install the first SEA and join it to AD 
 Create proper rules on SEA like: 
 Mail Delivery Servers: here specify the IP addresses to which SEA will send email from internet to internal domains. If you have an Exchange NLB, specify virtual IP 
 Mail Domains: specify the mail domains your organization manage (publically) 
 Internal Mail hosts: specify here the authorized mail server whom can send email to SEA. Here specify physical Exchange SMTP IP and not Virtual NLB address 
 Use the Sophos KB for best SEA spam catching techniques: https://community.sophos.com/kb/en-us/120802 
 Create the SEA cluster by joining the second SEA to the first one already configured 
 Create a new SMTP connector on Exchange that sends email to SEA 
 Create a SMTP relay connector on Exchange to receive email only from SEA IPs 
 
 Regards

Ismail Shareef Mohammed · Answer

Thanks for your help, it worked well. 
 We also had to disable Exchange Sender ID as many of the mails were bouncing if other people were sending us the mails. 
 Powershell : Set-SenderIDConfig -ExternalMailEnabled $false