Process inbound, outbound and internal email

As the transport rule applies to all email, Email Gateway Security will process inbound, outbound and Exchange internal messages, too.

This behavior can be finetuned adjusting the appropriate parameters of the transport rule.

For details see step 4 in the section Transport rule to forward to Email Gateway Security and the sub-section Customizing what emails to send to Email Gateway Security below.

Known issues

Overview

We will create a hook in Office 365 email flow to forward emails to Email Gateway Security for processing.

Email Gateway Security will receive the connections from Office 365 on SMTP port 25, and will forward the processed emails to Office 365 email exchange to SMTP port 25.

The following configuration must be performed:

1. Inbound SMTP configuration to receive emails on port 25, and

2. Security Rule configuration to relay to Office 365 mail exchange.

Inbound SMTP configuration

Configure Email Gateway Security’s SMTP server to listen on port 25 (by default Email Gateway Security listens on port 10025).
For details see 4.3. Settings.

Security rule configuration

Email Gateway Security’s Security Rules must be configured to forward processed emails back to Office 365’s mail exchange.

Perform the following steps:

1. Discover your Office 365 mail exchange FQDN
   Issue the following commands:

   nslookup

   set type=mx

   your.domain.com

   Example:

2. Create an SMTP type server profile that points to the mail exchange discovered in the previous step.
   For details see 4.6. Server profiles.
   
   For example if your mail exchange is your.domain.com then specify this as the SMTP server URL address:

   smtp://your.domain.com:25

   

3. Set this SMTP server profile as the SMTP relay server profile for security rules that are intended to process email from Office 365.
   For details see 4.4. Policy.
   

Email Gateway Security is now ready to receive emails from Office 365, and then return them there after processing.

Overview

We will create a hook in Office 365 email flow to forward emails to Email Gateway Security for processing.

We will create a transport rule to forward emails to Email Gateway Security through an outbound connector.

Then we will create an inbound rule to configure Office 365 to receive emails back from Email gateway Security.

The configuration is done in Exchange admin center available at https://admin.exchange.microsoft.com/.

Connector to Email Gateway Security

Perform the following steps:

1. In Exchange admin center go to Mail flow > Connectors
   

2. Click Add a connector
   

3. This connector will route email from Office 365 to Email Gateway Security, so in the New connector dialog select:

   1. Connection from: Office 365

   2. Connection to: Your organization’s email server
      

4. In the Connector name dialog give a descriptive name to the connector and enable Turn it on
   

5. Later we will create a transport rule to redirect messages in certain cases only to Email Gateway Security, so in the Use of connector dialog select Only when I have a transport rule set up that redirects messages to this connector.
   

6. In the Routing dialog specify the address of the Email Gateway Security instance
   

7. In the Security restrictions dialog apply TLS settings according to your standards

8. In the Validation email dialog validate the connector
   

9. In the Review connector dialog click Create connector to save the configuration
   

10. The new connector must appear in the list of connectors. The outbound connector is now ready to route emails.
    

High availability and load balancing of multiple Email Gateway Security instances

When multiple Email Gateway Security instances are available to process emails in Office 365, then all these Email Gateway Security instances can be specified in the Routing dialog, as a list.

In this case, Office 365 - based on its own algorithm - will send the email to only one of these instances.

Office 365 will be able select an Email Gateway Security instance that is functional.

Transport rule to forward to Email Gateway Security

Perform the following steps:

1. In Exchange admin center go to Mail flow > Rules
   

2. Click + and select Create a new rule to add a new transport rule
   

3. In the new rule dialog click More options…
   

4. Configure the rule in the following way:

   1. Name: give a reasonable name

   2. *Apply this rule if…: [Apply to all messages]

   3. *Do the following…: Use the following connector…: the connector to Email Gateway Security

   4. Choose a mode for this rule: Enforce
      

   5. Stay in the new rule dialog and continue with the transport rule exception.

Transport rule exception

The transport rule exception is part of the transport rule. Using this exception we will avoid recursive loops of emails being sent back and forth between Office 365 and Email Gateway Security. Emails that are coming from and that have already been processed by Email Gateway Security won’t be sent to Email Gateway Security again.

Perform the following steps:

1. In the new rule dialog click add exception
   

2. Select The sender… > IP address is in any of these ranges or exactly matches
   

3. Specify the IP address of Email Gateway Security. This way emails coming from Email Gateway Security won’t be sent there back again and again.
   
   

4. Save the rule. It will show up in the list of rules.
   

Customizing what emails to send to Email Gateway Security

As the transport rule was configured to apply to all email, using this rule all email will be sent to Email Gateway Security for processing.

In certain cases not all email is desired to be processed by Email Gateway Security. In these cases the range of emails to be forwarded can be configured setting *Apply this rule if… accordingly.

Example

Let us assume, that at an organization only inbound email needs to be processed by Email Gateway Security.

We can easily achieve this by setting *Apply this rule if… to The recipient is located… Inside the organization.

Connector from Email Gateway Security

Perform the following steps:

1. In Exchange admin center go to Mail flow > Connectors (note that the outbound connector previously created is already in the list)
   

2. Click Add a connector
   

3. This connector will route email from Email Gateway Security to Office 365, so in the New connector dialog select:

   1. Connection from: Your organization’s email server

   2. Connection to: Office 365
      

4. In the Connector name dialog give a descriptive name to the connector and enable Turn it on
   

5. In the Authenticating sent email dialog select By verifying that the IP address of the sending server matches one of the following IP addresses, which belong exclusively to your organization and specify Email Gateway Security’s IP address
   

6. In the Review connector dialog click Create connector to save the configuration
   

7. The new connector must appear in the list of connectors. The inbound connector is now ready to route emails.