Sophos XG as MTA mode but not gateway, how to configure it?

Question

We want to use Sophos XG as anti-spam proxy, there is another firewall (ASA) in network as gateway, how can I made the configuration with MTA mode but it is not gateway ? I searched the solution on Sophos KB, there is only one document to describe how to configure MTA mode but it doesn't match my scenario, in my network ,there is only one connection from Sophos to DMZ. do I need to creat a Dummy IP on WAN port but no physical connection on WAN port?

This thread was automatically locked due to age.

rfcat_vk · Answer

Hi, 
 you can setup two ports in bridge mode that does not affect the existing port configuration. You would then use firewall rules for the local traffic access to the email server. 
 Ian

MasterRoshi · Answer

Hi Chanqgqing, 
 This becomes a bit more complicated since some of the configuration has to be done on the email server side and gateway device. 
 Basically you need the following. 
 1. For inbound email you need to DNAT port 25 to the XG at the gateway (unless the XG is already the gateway or you can point the MX records directly to it). 
 2. For outbound email you need to create send connectors (exchange) and set the XG as the smarthost. 
 Now as long as you have the XG correctly configured, you should have both inbound and outbound going through it.

LuCar Toni · Answer

Funny part about XG MTA is, you do not need a FW rule at all to make the proxy working. 
 Simply enable in device Access "SMTP Proxy" for your Zone and configure your MTA Mode properly in Email (Host based Relay for your internal Mail server and your domain). 
 Then configure your DNAT SMTP Rule on your Firewall (ASA) and point to XG. 
 Should work fine. 
 Firewall Rules for SMTP MTA are only needed in case you want to MASQ certain traffic.