In a similar way, the network must be configured so that incoming email messages from the
Internet are delivered to the appliance, not the internal mail server.
Figure 5: Relaying email traffic
The appliance scans the traffic before forwarding it, on behalf of the sender, to the internal
mail server for delivery, as shown in
Figure 5: Relaying email traffic
.
For example, an external mail server can communicate directly with the appliance, although
traffic might pass through several network devices before reaching the appliance. The perceived
path is from the external mail server to the appliance.
Protocols
To scan a supported protocol, you must configure your other network devices or client computers
to route that protocol through the appliance, so that no traffic bypasses the appliance.
Firewall rules
Explicit proxy mode invalidates any firewall rules set up for client access to the Internet. The
firewall sees only the IP address information for the appliance, not the IP addresses of the
clients, so the firewall cannot apply its Internet access rules to the clients.
Where to place the appliance
Configure the network devices so that traffic needing to be scanned is sent to the appliance.
This is more important than the location of the appliance.
The router must allow all users to connect to the appliance.
Figure 6: Explicit proxy configuration
The appliance must be positioned inside your organization, behind a firewall, as shown in
Figure
6: Explicit proxy configuration
.
Typically, the firewall is configured to block traffic that does not come directly from the appliance.
If you are unsure about your network’s topology and how to integrate the appliance, consult
your network expert.
Pre-installation
Considerations about Network Modes
McAfee Email and Web Security Appliance 5.1 Installation Guide
14
