Hello Andy,
I don't see any general problems with this setup of using the second NIC for relaying messages from the internal network to the Internet, it's actually quiet common I'd say. The only think you maybe want to consider is if you only want to allow specific hosts to connect and relay, or whole network segments. The latter comes with a big drawback that when a PC or server gets infected with malware it has a direct access to send tons of spam outside the network, which will not only clogg your IronPort and cause delays on mail delivery, also your Senderbase reputation will be affected. So instead we recomment to still limit any relaying sendergroup to a few hosts, like the alerting servers you been talking about, and let the rest of the network still have to use your Exchange server. Also like you already mentioned it is a good idea to use any throttling on your alerting servers to prevent that the IronPort gets flodded with alerts. A possible setup would be something like this:
- enable the second network interface
- enable a private listener on it
- put the Exchange server on the RELAYLIST of this private listener
- add a new mail flow policy (GUI: mail Policies->Mail Flow Policies->Add Policy) to the private listener. Make sure the correct listener is selected, as there is a different set for each listener. In that new mail flow policy, set the connection behavior to "Relay", and adjust the settings to your requirements.
- add a new sendergroup to the HAT of that private listener (gain, make sure the correct listener is selected first). Use the new relay mail flow policy you have just created, and add all the alerting servers to this sendergroup.
-Submit and commit
You may also add virus scanning and filters to the outbound mail policies of this appliance.
Hope that helps,
regards, Andreas
