INLINE INGUARD GUARDIAN

Transcription

1 INLINE INGUARD GUARDIAN Activation Guide December 8, Lakeshore Parkway, AL InLine 1

2 InLine InGuard Guardian Activation Guide The InLine InGuard Guardian Activation Guide is designed to confirm basic account information and to provide you with the information you ll need to begin protecting your organization from spam, viruses and worms, attacks, and inappropriate or dangerous content and attachments. The Activation Guide also includes configuration information for InLine Directory Integration. The last two pages of the Activation Guide include important information on: InLine Customer Portal our online customer support services portal InGuard Console SM the InLine web-based administrative platform InLine Education Services includes times and dates for Service Administrator training sessions InLine Contact Information Includes contact information for InLine Customer Support Services, technical support and provisioning inquiries. Your InLine Service Customer Name: <customer name> Customer Number: <customer number> Service Package: < Service package> InGuard Console SM Web Address: InGuard Console Username: <user > InGuard Console Password: <password> Configure the InGuard Administrators 1. Log into the InGuard Console Log into the InGuard Console at the Web address listed above. 2. Verify Protected Status of Customer Admin User Account If your organization plans to use InGuard Directory Integration it is important that the User Status of your Customer Administrator User Account (the Username listed above) is set at Protected, and not Active or Inactive. To confirm or change the Status, navigate to Account Management Users Accounts. Select specific Account Click Edit Change Status from Active to Protected 3. Provision additional Administrators If more than one individual will have administrative responsibilities for your account, Customer Administrators can create additional Customer Administrators in the InGuard Console. In order for the additional Customer Administrators to be able to submit Customer tickets, you will need to contact InLine Customer Support, which will provision the additional Customer Administrators. 2

3 Configure the InLine InGuard Guardian 4. Verify Inbound Server host addresses and preferences Go to InGuard Guardian Setup/Inbound Servers, and verify that the Inbound Server host addresses are accurate and that the appropriate preferences are defined for the host addresses. 5. Verify Domains/Verify Domain Spelling Go to Account Management/Domains to verify that your domains are present and that they are spelled correctly. 6. Verify Outbound Server IP address(es) (if applicable) If your service package includes Outbound Filtering, go to InGuard Guardian Setup/Outbound Servers and verify the Outbound Server public IP host address(es) for accuracy. 7. Determine User Creation setting/create Users Go to InGuard Guardian Setup, where you can determine whether you want the system to auto-create User Accounts or if you want to control User Account creation. You also can specify how an inbound message should be handled when it is addressed to a recipient that is invalid or does not exist. InLine strongly suggests that the User Creation option be set to Explicit, which can be done at any time. The Explicit setting is recommended if you plan to create users via InLine Directory Integration (detailed later this document). If the User Creation option is changed from SMTP Discovery to Explicit, the Administrator should immediately delete any invalid User Accounts. From this point forward, the Administrator will maintain the creation of User Accounts manually. 8. Verify Policy Settings Go to InGuard Guardian Policies to determine how the Service will handle incoming messages that contain threats (spam, viruses, etc.), the distribution of Spam Quarantine Reports, and to set up Allow and Deny Lists and internal violation notifications. Determine Anti-Virus Actions Determine Anti-Spam Actions Determine Distribution Requirements for Spam Quarantine Reports Determine Content Actions Determine Attachment Actions Configure Allow and Deny Lists Set up Notifications for Virus, Attachment or Content violations. 9. Redirect your Mail Exchange (MX) Record As noted above, InLine has provisioned domain.com in the InLine systems. In order to begin filtration, you or your Internet Service Provider need to redirect your mail exchange (MX) record for all protected domains: [fully qualified domain name].inbound10.mxlogic.net at a preference level of 10 [fully qualified domain name].inbound10.mxlogicmx.net at a preference level 10

4 Additional domains should be redirected in the same manner. Do not redirect your mail exchange (MX) record to anything other than what you see listed above. Use of other MX records may cause mail to bypass the filtering system, increasing threat exposure. Once the MX Record changes are propagated, inbound mail for the specified domain(s) will begin being filtered by InLine. 10. Lock down SMTP to your mail server Customers using Cisco PIX or ASA firewalls: We suggest the SMTP Fix Up or Inspect ESMTP settings be disabled on your firewall prior to setting up your InLine service. Customers subscribing to InLine Outbound Message Filtering: InLine recommends that you test for and disable any open relays on your mail server or network. Open relays are a major security concern, which if not corrected, can result in the immediate shutdown of Outbound Message Filtering by InLine. Follow the steps below to properly lock down SMTP to your mail server. Customers using firewalls with built-in spam filtering (i.e., Barracuda): Some firewalls using built- in spam filtering may block some InLine IP addresses. If you use such an appliance and it is behind another firewall, it is recommended to also add the InLine IP ranges to the appliance so that traffic from InLine is accepted. Not doing so can cause intermittent interruptions to delivery. Note that some older versions of these appliances do not allow input of IP addresses/ranges. In this case, it is recommended that the appliance be disabled/removed from service as InLine will provide the same type of spam filtering with a more user-friendly configuration. Customers using Sender Policy Framework (SPF): InLine recommends that customers using the InGuard Guardian for inbound mail filtering disable any SPF check and/or rejection, based on SPF failures. This will prevent delivery difficulties when the message is seen by a recipient as being sent by InLine, as opposed to the actual sender. Customers who subscribe to InLine Outbound Message Filtering should include the following segment in their SFP record to ensure that recipients understand that mail is being sent by InLine on behalf of your organization: include:mxlogic.net For more information on Sender Policy Framework, see: Five to seven days after redirecting your MX Record, it is recommended that the Customer Administrator for your organization lock down your mail server(s) or create firewall rules that will ensure that only filtered mail from InLine will be delivered to your server(s). To ensure that no mail is presented to your mail server without being processed by InLine, you will need to restrict all IP access to your mail server with the exception of the following InLine subnets. The InLine preferred setting is to include the Classless Inter-Domain Routing (CIDR) for the entire Class 8 C notation. Alternate settings are also provided below. Preferred Setting If your firewall solution accepts Classless Inter-Domain Routing (CIDR) and can support Class 8 C notation please include the following:

5 CIDR Starting IP Ending IP / / Alternate Setting (1) If your firewall solution accepts Classless Inter-Domain Routing (CIDR) and only supports Class 1 C notation, you will need to include the following entries to the entire subnet: CIDR Starting IP Ending IP / / / / / / / / / / / / Alternate Setting (2) If your firewall solution does not accept Classless Inter-Domain Routing (CIDR) notation, you will need to include the starting and ending IP address for either the Class 8 C addresses or the Class 1C addresses which are included above. Least Desirable Setting If your firewall does not accept Classless Inter-Domain Routing or IP starting and ending ranges, you can download a complete listing of affected IPs at Any of the above changes can be done by creating a firewall rule, or restricting access at the server level. We highly recommend that you lock down these subnets at your firewall as the priority preference. Please consult with your network administrator before making any changes. For additional information regarding the restriction of IP addresses please refer to instructions from your firewall setup or from your firewall provider. Testing Your Configuration Once you have completed this process, visit and complete the Configuration Test Form, which will confirm whether or not the reconfiguration instructions were properly implemented for each domain. 11. Define smart host or relay for Outbound Filtering (if applicable). If your Service package includes Outbound Message Filtering, the Customer Administrator is responsible for establishing a smart host or relay on their mail server, directing outbound mail flow through InLine. Please note that the following steps will be required during the service configuration process to provision Outbound Message Filtering as part of your service package. Each outbound domain will need to be configured with the appropriate information. Enter the public IP address(es) associated with the outbound service on your mail server on the InGuard Console SM Setup tab, Outbound configuration. If you use a

6 consecutive block of outbound IP addresses these addresses may be referred using CIDR notation (ex. 4 consecutive addresses = " /30" or 32 consecutive addresses = /27 ). To ensure the strictest security, InLine recommends that only single IPs or CIDR notation for a /32 should be used to configure your outbound smart host or relay. Establish a relay or smart host sending outbound traffic to the following addresses: o o [fully qualified domain name].outbound10.mxlogic.net [fully qualified domain name].outbound10.mxlogicmx.net After these tasks have been completed, InLine can accept all of your outbound for filtering of virus, worms and inappropriate content and attachments, and based on customer configuration, can include your customized outbound disclaimer to all outbound messages. 12. Introduce the service to End-users You may want to create a plan to roll the Service out to your Users; review Preferences available to Users, explain how to use Spam Quarantine Reports and when to enter sender addresses on the User-level Allow and Deny Lists. To help introduce the Service, you may use the InGuard Management Quick reference guide available from End users that use Outlook 2003 or 2007 can also take advantage of the complimentary InLine Spam Control for Outlook feature, which enables them to click a Delete As Spam button on their Outlook toolbar to: Immediately delete suspect messages from the Inbox. Simultaneously send the messages to the InLine Threat Center for analysis and action. The Delete As Spam button can be downloaded by users by visiting: Fine Tune Your Service Monitor mail flow and your Message Quarantine As the Customer Administrator, it will be important to monitor the messages that appear in the Message Quarantine areas and to review the various Service mail flow statistical reports. Reviews of Message Quarantine areas should be performed to ensure that messages from senders of desired organizations are not being quarantined unnecessarily. Those sender addresses may be added to the Policy-level Allow List. Senders from undesired organizations can also be determined by Message Quarantine monitoring, and those senders can be added to the Policy-level Deny List. Reports and Statistics detail traffic, threats encountered, message released from the Quarantine, inbound server connections, and more. Reviewing the Reports will provide information that can help the Administrator to fine-tune Policy Set definitions.

7 Modification of User Creation Setting (if applicable) If SMTP Discovery has been selected as the User Creation option, there may be User Accounts in the InGuard Console that do not exist on your mail server. Administrators are encouraged to delete those invalid User Accounts. InLine strongly suggests that the User Creation option be set to Explicit, which can be done at any time. If the User Creation option is changed from SMTP Discovery to Explicit, the Administrator should immediately delete any invalid User Accounts. From this point forward, the Administrator will maintain the creation of User Accounts manually. Configure InLine Directory Integration InLine Directory Integration is a user directory synchronization service that simplifies management of InLine managed security services. Service administrators can use Directory Integration to synchronize changes made in their Active Directory, including primary and alias addresses and distribution lists, with the InLine system. Please note: InLine strongly recommends that the Explicit user creation mode, and not SMTP Discovery, be used in conjunction with Directory Integration. Administrators can easily set up an automated schedule for the synchronization of account information, ranging from one to four times per day, or they may also initiate a manual synchronization through the InGuard Console. Directory Integration is available for customers that meet the following requirements: Access to the InGuard Console. A valid administrative account on the InGuard Console that will be protected from changes during synchronization with the Active Directory. A supported version of Microsoft Active Directory server (v2007, v2003, v2000, or v5.5) To configure Directory Integration for your organization, visit the InGuard Console at the address listed on the first page of this document and navigate to Account Management > Sync Setup. Key InLine Service Information The InLine Customer Portal The InLine Customer portal is accessible 24x7, and enables you to: View and download InLine reference materials. Review the process for submitting Customer tickets, which can be used to report service questions and issues and billing inquiries. Service Requests are generated and sent directly to InLine Customer Support Services. You can also track the progress of your requests through the Customer portal.

8 View current status information for InLine systems. InLine regularly updates System Status messages to keep customers informed of issues that may be affecting the performance of the InGuard Console or InLine managed security services. InGuard Console SM The InGuard Console is a centralized, web-based administration and reporting platform that provides you with one interface for managing all InLine managed security services. InLine Education Services InLine provides educational information through it's customer support site at and additional assistance is available by contacting our help desk InLine Contact Information InLine General Information Customer Support Services, Technical Support, Provisioning Inquiries 600 Lakeshore Parkway Toll-free: InLine Ext. 119 ( ), AL Direct: Toll-free: InLine Hours: 24 x 7 ( ) Customer: Direct: Fax: Website: [email protected]