Setup Sophos UTM 9 as a smart host to relay to Mimecast

Question

Hi 
 We currently have 2x UTM 9 on different sites and have an issue with our outbound mail flow in a DR scenario. The mail flows fine though our primary site but we cannot get it to route through to the secondary site, so I guess this is a routing issue of some sort. 
 We have got inbound mail working ok via both sites, so I think we need to redesign the outbound somehow. 
 The current exchange setup has one send connector which specifies 2 mimecast dns entries as its smart hosts. When doing a telnet you can hit these fine. 
 What we would like to do is change the send connectors smart hosts to point to the internal address of the UTMs at each site instead. 
 This would hopefully give the flexibility we need for outbound mail in a DR scenario, unless there is a better way of doing it? 
 I have tried doing a telnet to the internal IP address of the UTM on port 25 but it does not work. So I am after some advice on the best practice for the UTM to relay SMTP traffic from our exchange servers IP addresses directly to mimecast. 
 We do not need any additional functionality that the UTM has in regards to email scanning etc as this is already done for us. 
 I have taken a look on the community and come across similar situations but I would like some more clarity on how to do this please 
 . 
 Any advice is grateful.

Colchester Institute IT Services · Answer

1. Our second site has resilient LES circuit links which allow the primary and dr site to connect directly. 
 2. There is a failover exchange server on the DR site in case of a full datacentre fail. 
 I think we have managed to work this out for resilient outbound mail flow now, with your availability group and SNAT/DNAT idea instead of using the default gateway on the primary site or using the SMTP functionality module of the UTM. We have setup the firewall on the UTMs to listen for port 25 traffic on its internal eth for specific internal IP addresses on the network, these being the exchange servers. 
 The UTM will route any smtp traffic outbound to our mimecast cloud account directly via its external int. 
 Mimecast is set to accept smtp traffic from one of our public facing IP addresses at each site which the UTM uses. 
 On the exchange servers I can telnet from the exchange server to the internal IP address of the UTM at each site and get a response from the mimecast servers. 
 This will now allow me to put the UTM internal eth IPs at each site as the smarthost in exchange for the outbound mail flow. 
 Using one smart connector if there is an issue that is beyond the UTM it is easy to remove one of these IPs for outbound mail flow. 
 It should also loadbalance the outbound mail via the 2 different connections now. 
 many thanks