MX LB / HA / Cluster ESA 380

[mariappans]

We go to deploy our new ESA (2 devices) as per mentioned below plan,

ESA01 is primary for company A and ESA02 is primary for company B.

If ESA01 is down ESA02 will receive mail for company A using MX load balance. The same method for company B.

We are very confused on cluster with MX load balance on above scenario.

Like Two different ESA configurations devices can able include on single cluster. Since we have different policies for both companies and both companies have email server .

We need some explanation on above.

Please clarify on this

[Ken Stieers]

"Cluster" in ESA just means the configuration gets replicated.

So if you cluster them and want different policies for each company, you just go to Mail Polices/Incoming Mail Policies and create one for each company.

Add each domain you receive mail for to Mail Polices/Recipient Access Table

Add a route to each mail server for each domain under Network/SMTP routes

If you want separate "Host Access Tables" you can create separate listeners for each company (under Network/Listeners), and you may want to put them on separate IP interfaces, but you don't have to do this... one HAT may work just fine...

[gfernandez.glatam]

Now, somebody can tell me if this configuration gives HA for the mail service?

thanks

[Ken Stieers]

Yes, assuming that the configuration on the ESAs is the same (e.g. clustered), this should give you HA...

[ZoreckAmb14]

Hi Ken, 

I have a doubt, I have considered to use the similar scenario but I´m not sure what is the best practice,

I want to use two pairs of ESA in cluster cause I need HA I  would think the scenario propose as below show 

Can you give me your comments?

[Ken Stieers]

Keep this in mind, clustering of the ESA has NOTHING to do with HA... It just synchronizes configurations.

You get HA by configuring MX records and your emails system's outbound connectors.

Only buy 4 if you need to carry that much load.

You can put the ESA anywhere in your network, we used to have both interfaces inside the network.

I usually put the "public" port in the DMZ, and the private port inside.  Some people don't like the "bridging" a firewall" so they put the whole thing out in the DMZ...