Allow exchange | mail flow in and out of the firewall

Hi all,

I am getting myself a little confused here..

I have an exchange server and i have a firewall (the make and model is not relevant but its an ASA)

I understand that the firewall needs to allow port 25 | SMTP outbound.

However... What ports do i need to allow inbound on the firewall? Assuming the MX record points directly to the public IP address of the exchange server and NOT some other third party mail service such as Mimecast or Trend Hosted Email Security.

My understanding is that if i use a third party such as Mimecast or Trend Hosted Email Security i can lock down the firewall and allow only the Mimecast or Trend public IP addresses inbound connections to my exchange server.

To summarise, what ports do i need to enable inbound on my firewall for exchange to be able to receive mail?

Thanks in advance.