RE: Is any access possible from DMZ to PRO ?

[Michael W. Burden]

You may also want to consider upgrading your GNAT Box to 2.2 or
later.  This would allow you to use the email proxy, which in
turn would allow you to keep the mail server on the PRO network
without opening a tunnel to it.