MTA on R80.3

[Dick_Summers]

I am setting up Threat Emulation and Threat Extraction on a R0.3 ClusterXL.
First I need to get MTA working.
All Internet traffic goes through one port on the cluster, going to two network hosts, each with its own static IP configured through each object's NAT setting. The internal email server object is one of these hosts.
I have created an Access Control Policy to send email from any source to destination email host, smtp and smtps services, which is working.
I have set up MTA to forward to the email server host. Smartview show email is not going through the MTA. The email server's certificate has been imported to the MTA.

Questions:
1) Do I need to disable NAT on the email host?
2) Access Control Policy:
2a) Do I need to change the destination to the "local machine" host?
2b) Should I disable/delete the existing Access Control Policy and enable by checking the box in the MTA configuration?

Is there something else I am missing?

[Wolfgang]

Hello **bleep**,

yes there is something wrong now if you want to use MTA.

Without MTA, messages to your domain are send to the IP which holds the mx record for your domain. I think, this the IP which is NATed to your mailserver. 
With MTA, the MTA should first get the messages, doing all checks ( ThreatPrevention, AntiSpam etc.) and then deliver to the internal mailserver. Normally you don‘t need any NAT for this.

To your questions:

>> 1) Do I need to disable NAT on the email host?

Yes
>> 2)  Access Control Policy:
>> 2a) Do I need to change the destination to the "local machine" host?

You need a rule allowing smtp to the IP of your mx record or the external  IP for getting the messages.

You need a rule allowing smtp from the gateway to the IP of your internal mailserver.

You need a rule allowing smtp to 127.0.0.1, this needed for ThreatPrevention.

>> 2b) Should I disable/delete the existing Access Control Policy and enable by checking the box in the MTA configuration?

Yes, that‘s the better way. But be aware you need a rule for allowing smtp to your internal mailserver.

>> Is there something else I am missing?

You need a first ThreatPrevention rule with protection scope to your gateway and service SMTP. This is created automatic if you enable MTA. If you want to enable AntiSpam, you have to enable and configure this. This has nothing todo with the MTA, the configuration is done with old SmartDashboard.

And you have to tune your maillogs, or postfix configuration if you need more special configurations.

 Regards

Wolfgang