Configure Beta ESA to Accept Production ESA Traffic

Transcription

1 Configure Beta ESA to Accept Production ESA Traffic Contents Introduction Prerequisites Requirements Components Used Configure Beta Appliance Listener Configuration for Beta ESA Sender Group for Beta ESA Simple Mail Transfer Protocol (SMTP) Routes for Beta ESA Configure Production Appliance SMTP Routes for Production ESA Message Filter Construction for Production ESA Verify Troubleshoot Additional Information Related Information Introduction This document describes how to configure a Beta Cisco Security Appliance (ESA) in order to accept production ESA traffic via a message filter. Prerequisites Requirements There are no specific requirements for this document. Components Used This document is not restricted to specific software and hardware versions. The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command. Configure Beta Appliance Listener Configuration for Beta ESA

2 The initial Listener configuration is to be completed on the Beta ESA. 1. From the GUI, navigate to Network > Listeners. 2. Click Add Listener Name and setup a Public Listener that runs on TCP port Click Submit in order to save the changes to the Public Listener. 5. Repeat the same steps and add a second listener. 6. Name and setup a Private Listener that runs on TCP port 26. (This listener is used for outbound mail.) You may use port 25 if there is an additional interface available and configured for your environment. 7. Submit to save changes to the Listener. 8. Commit to save all changes to the configuration. Sender Group for Beta ESA For relayed traffic or outbound messages, add in the appropriate IP address(es) for the Beta ESA in order to accept and relay messages from the Production ESA. 1. From the GUI, navigate to Mail Policies > HAT Overview. 2. Select the appropriately named Relay Sender Group. (This is usually named RELAY, or RELAYLIST.) 3. Click Add Sender For Sender, use the IP address of the Production ESA. 5. Enter any administrative comments, as needed. 6. Submit to save changes to the Relay Sender Group. 7. Commit to save all changes to the configuration. Simple Mail Transfer Protocol (SMTP) Routes for Beta ESA SMTP Route changes that need to be made on the Beta ESA are as follows: 1. From the GUI, navigate to Network > SMTP Routes. 2. If there are current SMTP routes, you may need to select those and Delete before you proceed. (Ensure to review the the Beta Lab Setup Guide.) 3. Click Add Route Set the Receiving Domain as cisco.com and Destination as USEDNS. 5. Click Submit. 6. Repeat the same steps and add in a second SMTP route. 7. Set Receiving Domain for ironport.com and Destination as USEDNS. 8. Click Submit. 9. Finally, select All Other Domains from Receiving Domain. 10. Set the Destination as /dev/null. (This prevents routing mail from the Beta appliance for any domains not configured.) 11. Click Submit. 12. Commit to save all changes to the configuration. At this time, SMTP Routes on the Beta appliance is as shown in the image:

3 Note: Add the appropriate routes to deliver s to test end-users for domains as needed. Configure Production Appliance Caution: You are about to make changes to a Production ESA. Ensure that you backup the current configuration. 1. From the GUI, navigate to System Administration > Configuration File. 2. From the Current Configuration section, select one of the options to back up the current configuration as a file: Download file to local computer to view or save. file to: <your_ _address@domain.com> 3. Click Submit. SMTP Routes for Production ESA SMTP routes must be added in order to allow BCC for all inbound and outbound s from the Production ESA to the Beta ESA. For this example, inbound.beta.com and outbound.beta.com are used. 1. From the GUI, navigate to Network > SMTP Routes. 2. Click Add Route Set Receiving Domain as inbound.beta.com with Destination as the IP address of the Beta appliance Public Listener created earlier, with the port set to Click Submit to save changes to this new SMTP route. 5. Repeat the same steps, Add Route Set the Receiving Domain as outbound.beta.com, Destination Hosts as the IP address of the Beta appliance private Listener created earlier, and the port to Submit to save the changes to this new SMTP route. 8. Commit to save all changes to the configuration. At this time, SMTP Routes on the Production ESA as shown in the image:

4 Message Filter Construction for Production ESA From the CLI on the Production ESA, construct a message filter that can BCC s to the appropriate Listener on the Beta ESA. 1. Navigate to Filters > NEW. 2. Copy and Paste this message filter example and make the changes wherever appropriate: bcc-eft: if sendergroup == "RELAY" { bcc ("$enveloperecipients", "$Subject", "$EnvelopeFrom", "outbound.beta.com"); log-entry("<=====bcc COPY TO BETA ESA=====>"); } else { bcc ("$enveloperecipients", "$Subject", "$EnvelopeFrom", "inbound.beta.com"); log-entry("<=====bcc COPY TO BETA ESA=====>"); }. 3. Return until you are back to the main CLI prompt. 4. Commit to save all changes to the configuration. Note: Limit the traffic copied in the message filter based on sendergroup, recv-listener, mailfrom, or other available rules and syntax. Consult the ESA User Guide for complete Message Filter Rules and Filter Rules Summary. Verify Use this section in order to confirm that your configuration works properly. At this time, the Beta appliance accepts traffic from Production appliance. In order to verify from CLI on the Beta appliance, run tail mail_logs: Wed Mar 23 17:28: Info: New SMTP ICID 2 interface Management ( ) address reverse dns host dhcp cisco.com verified yes Wed Mar 23 17:28: Info: ICID 2 RELAY SG RELAY match /24 SBRS not enabled Wed Mar 23 17:28: Info: Start MID 2 ICID 2 Wed Mar 23 17:28: Info: MID 2 ICID 2 From: <test@test.com> Wed Mar 23 17:28: Info: MID 2 ICID 2 RID 0 To: <robsherw@ironport.com> Wed Mar 23 17:28: Info: MID 2 Message-ID '<a033ed$2@ local>' Wed Mar 23 17:28: Info: MID 2 Subject 'TEST 2' Wed Mar 23 17:28: Info: MID 2 ready 320 bytes from <test@test.com> Wed Mar 23 17:28: Info: MID 2 matched all recipients for per-recipient policy DEFAULT in the outbound table Wed Mar 23 17:28: Info: MID 2 queued for delivery

5 Wed Mar 23 17:28: Info: New SMTP DCID 3 interface address port 25 Wed Mar 23 17:28: Info: Delivery start DCID 3 MID 2 to RID [0] Wed Mar 23 17:28: Info: Message done DCID 3 MID 2 to RID [0] Wed Mar 23 17:28: Info: MID 2 RID [0] Response '2.0.0 u2nhsipg Message accepted for delivery' Wed Mar 23 17:28: Info: Message finished MID 2 done Wed Mar 23 17:28: Info: ICID 2 close Wed Mar 23 17:28: Info: DCID 3 close The SMTP communication establishes on (Beta appliance). The address from which the traffic is sent is from is (Production appliance). The Sender Group that receives the communication is RELAY, relayed traffic from the /24 network. The rest is the communication of the TEST 2 message. On the Production appliance, verify and run tail mail_logs. The MID processed on Production would show: Wed Mar 23 14:50: Info: MID 242 was generated based on MID 241 by bcc filter 'bcc-eft' This would be a clear cut splintering of the message as received and BCC'd over to the Beta appliance and test end-user as intended for receipt. Troubleshoot There is currently no specific troubleshooting information available for this configuration. Additional Information A content filter may be considered in order to help differentiate Production vs. Beta traffic for test end-users. 1. From the GUI on the Beta ESA, navigate to Mail Policies > Incoming Content Filters or Mail Policies > Outgoing Content Filters. 2. Construct a basic content filter in order to perform an action of Add/Edit Header. 3. Click Submit in order to save changes to the content filter constructed. 4. Mail Policies > Incoming Mail Policies or Mail Policies > Outgoing Mail Policies, enable and add the new content filter to the Policy name. 5. Click Submit in order to save the content filter to that policy. 6. Click Commit in order to save all changes to the configuration. At this time, the content filter on the Beta ESA is as shown in the images:

6 Now, when an message is received on the Beta ESA you can see this in the Subject line of the once processed as shown in the image: Related Information How to configure an ESA/SMA for staging updates Technical Support & Documentation - Cisco Systems