We send and receive our mail via a hosted email filtering service (websense.....Yuk!!!) I've set my receive connectors up to only receive mail from the IP ranges given by Websense and also any internal ranges. Is this enough to prevent anyone sending mail directly to our exchange server or should the ports on the outfacing firewall of the server have the applicable IP ranges allowed? btw we dont use edge server

Ideally this should be enough as your servers will receive mail only from the permitted IPs and reject connections from any other IP's. However to restrict unnecessary traffic from reaching the Exchange servers it is recommended to open communication only with the intended SMTP servers at the network side(i,e Firewall). Hope this clarifies your doubt. Mahendra

HI, Agree with Mane. As your HUB server is behind the firewall and only websense IP is allowed in IP range , Its look fine..Anil MCC 2011,ITIL V3,MCSA 2003,MCTS 2010, My Blog : http://messagingschool.wordpress.com