HMC 4.0 - Exchange Server Network Hierarchy

The HMC 4.0 documentation is very vague on the networking aspect of the design. 
It says that every server is to have only one NIC, and that you should use VLANs
to allow and restrict access between the VLANs and servers, which is fine. 
However, in my lab I am not using a router to provide the connunication between
the network segments, I am placing two NICs in the server that need frontend and
backend network connectivity.

That information may be irrelevant to my question, but I thought I would throw
it out there.  My question is regarding the Exchange Server architecture.  If I
follow the documentation (and consolidate it a bit - I am not implmenting a
mailbox cluster), I will have a Mailbox server in Zone 3, a Hub server and a
Client Access/UM server in Zone 2, and an Edge server in Zone 1.  Step RUN.10
has me registering two IP addresses for the CAS/UM server (mail and webmail), an
IP address for the Edge server (smtpedge), and an IP for the Hub server (smtp). 
Is it normal to have the Hub server exposed to the internet?  I thought external
clients accessed Exchange through the CAS server and the Hub handled routing on
the inside between the various Exchange servers.  I would also think the Edge
server would be taking care of the SMTP traffic.  But according to the
documentation, all of the servers are hanging off the internet, except the
Mailbox server.  Does this seem normal?  Shouldn't the Edge server be able to
take care of all external requests?  I am confused.  Thanks!

If you don't have a router or a 3-layer switch to control traffic, Servers in
Zone2 should have 2 NICs, 1 for private(Zone 3), 1 for pulic.

And Edge server can handle all smtp traffics, so what you need to open for
internet access is as below:

Edge Server: SMTP  TCP port 25


CAS/UM Server: Https TCP port 443 (Or if you have POP3(s)/IMAP(s) services, open
them)

Regards,
Randy

Check procedure RUN.26. You need authenticated SMTP access from outside for
clients like Outlook Express.

So does that in fact mean the HUB server needs to hang off the internet?  Seems
like a pretty open architecture.

 I am implementing a router into the environment to provide VLANs, and will also
be using it to NAT the IPs from my ISPs.  I am starting to build a spreadsheet
that shows what ports need to be opened up between each server.  Has anyone
already done this?  Dont want to reinvent the wheel. Thanks!

Is the smtp.consolidatedmessenger.com address only used for Outlook Express
users?  If I do not plan on supporting Outlook Express clients can I forget
about the smtp DNS entry and NOT hang the Hub server off the internet?