Juniper Netscreen SSG-140: Inbound/Outgoing SMTP traffic on specific Untrust IP

SSG-140, 5.4.0r5.0

Relatively new to routing and firewalls so apologies in advance for my ignorance.

We have an e-mail server with 5 IP addresses in the DMZ: 10.0.0.71, 10.0.0.72, 10.0.0.73, 10.0.0.74, 10.0.0.75.

The e-mail server hosts 4 domains, each of which binds to its own dedicated IP address:

DomainA   10.0.0.72
DomainB   10.0.0.73
DomainC   10.0.0.74
DomainD   10.0.0.75

Using MIP on the Untrust interface and the appropriate policies we are able to get inbound traffic from a public IP address to the corresponding DMZ address with no problem.

Public        Private
1.0.0.72 = 10.0.0.72
1.0.0.73 = 10.0.0.73
1.0.0.74 = 10.0.0.74
1.0.0.75 = 10.0.0.75

Currently our very basic DMZ to Untrust routing configuration sends all outbound traffic with the SSG-140s Untrust address (1.0.0.120). The challenge now is to get the outgoing SMTP traffic from each e-mail server DMZ IP to go out with the IP address of the corresponding public incoming IP address.

From what Ive read, PBR seems to offer what we need (??), but how would I configure my interfaces?  If I try to create a sub-IF on ethernet0/0 (Untrust) with an IP address of 1.0.0.100 /26 (NOT currently named specifically elsewhere in the SSG-140) I get an overlapping IP error message.

Our interface configuration:

Untrust   ethernet0/0
Trust   ethernet0/8
DMZ   ethernet0/9

The Untrust interface is assigned an IP of 1.0.0.120 /26.

I have plenty of physical ports available on both the SSG-140 and my public switch.  That said, I dont want to use physical ports unnecessarily.

What is the best way to proceed so that I can direct incoming SMTP to the DMZ NIC and outgoing SMTP traffic from the DMZ in a way that it appears to be originating from a specific public IP?


TIA,
Rob