Best Practices: Exchange Server Setup

Group,
Wanted everyone's input on a Exchange server setup. I have read quite a few of the posts in the message group and see that it is NOT advised to place your Exchange server in the DMZ. I would like your input on how to make this work in the most functional way possible but also retain security. We would like clients on the outside world to be able to use OWA on PC's as well as PDA's and also have the option to VPN in to gain full functionality. I will provide the config below, the Exchange server currently has a IP on our intranet of 192.168.0.3 for reference with our gateway at .1 We currently have dynamic IP addresses however we have server side clients that will map to our FW's address. I believe this question for me is difficult so I will award points accordingly. Thanks in advance, let me know if you need any other info. Here is the config:

PIX Version 6.2(3)                  
nameif ethernet0 outside security0                                  
nameif ethernet1 inside security100                                  
nameif ethernet2 intf2 security10                                
enable password 2KFQnbNIdI.2KYOU encrypted                                          
passwd YHP/GpHoiUQdMATS encrypted                                
hostname MeccaNetPix                    
domain-name somename.com                          
fixup protocol ftp 21                    
fixup protocol http 80                      
fixup protocol h323 h225 172                          
fixup protocol h323 ras 1718-1719                                
fixup protocol ils 389                      
fixup protocol rsh 514                      
fixup protocol rtsp 554                      
fixup protocol smtp 25                      
fixup protocol sqlnet 1521                          
fixup protocol sip 5060                      
fixup protocol skinny 2000                          
fixup protocol sip udp 5060                          
names    
access-list 101 permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0                                                                            
access-list 102 permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0                                                                            
no pager        
logging trap notifications                          
interface ethernet0 auto                        
interface ethernet1 auto                        
interface ethernet2 auto shutdown                                
mtu outside 1500                
mtu inside 1500              
mtu intf2 1500              
ip address outside dhcp setroute                                
ip address inside 192.168.0.1 255.255.255.0                                          
ip address intf2 127.0.0.1 255.255.255.255                                          
ip audit info action alarm                          
ip audit attack action alarm                            
ip local pool ippool 192.168.2.1-192.168.2.254                                              
no failover          
failover timeout 0:00:00                        
failover poll 15                
failover ip address outside 0.0.0.0                                  
failover ip address inside 0.0.0.0                                  
failover ip address intf2 0.0.0.0                                
pdm logging informational 100                            
no pdm history enable                    
arp timeout 14400                
global (outside) 1 in                    
nat (inside) 0 access-list 101                              
nat (inside) 1 0.0.0.0 0.0.0.0 0 0                                  
conduit permit icmp any any                          
timeout xlate 3:00:00                    
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si                                                                                
p 0:30:00 sip_media 0:02:00                          
timeout uauth 0:05:00 absolute                              
aaa-server TACACS+ protocol tacacs+                                  
aaa-server RADIUS protocol radius                                
aaa-server LOCAL protocol local                              
no snmp-server location                      
no snmp-server contact                      
snmp-server community public                            
no snmp-server enable traps                          
floodguard enable                
sysopt connection permit-ipsec                              
no sysopt route dnat                    
crypto ipsec transform-set myset esp-des esp-md5-hmac                          
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap client configuration address initiate
crypto map mymap interface outside
isakmp enable outside
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup meccanet address-pool ippool
vpngroup meccanet dns-server 192.168.0.2
vpngroup meccanet wins-server 192.168.0.4
vpngroup meccanet default-domain somename.com
vpngroup meccanet idle-time 1800
vpngroup meccanet password ********
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
terminal width 80
Cryptochecksum:04ce48a03d0c114ce69a193984429168
: end
MeccaNetPix(config)#