Admin Tasks. Mimecast Training. Student Workbook. V Mimecast. All rights reserved

Transcription

1 Admin Tasks Mimecast Training Student Workbook V Mimecast. All rights reserved

2 Information in this document is subject to change without notice. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express prior written permission of Mimecast Limited. A reference to Mimecast shall be deemed to include Mimecast Limited, Mimecast Services Limited, Mimecast South Africa (Pty) Limited, Mimecast Offshore Limited, Mimecast North America Inc. and Mimecast Middle East. Copyright 2013 Mimecast Limited. All rights reserved. Mimecast is a registered trademark. Unified Management, Secure Messaging Gateway, Message Archive, Stor5, Mimecast Storage Grid, Enhanced Stationery, ARMed SMTP, Always On, UEM Express, UEM Enterprise, UEM Advanced, Mimecast Protect, Mimecast Multi, Mimecast 180, Mimecast Small Business Edition, Mimecast Services for Outlook, Mimecast Synchronization Engine, Mimecast Services for BlackBerry, Unified Management for Domino, Unified Management for Groupwise, Mimecast Services for Sharepoint, Mimecast Personal Portal, ZHARA and Where business banks its data are trademarks of Mimecast Limited. All other names are trademarks or registered trademarks of their respective owners. Any omission or misuse (of any kind) of service marks or trademarks should not be regarded as intent to infringe on the property of others. Mimecast disclaims all warranties, either expressed or implied, including, but not limited to, implied warranties of merchantability and fitness for particular purpose, with respect to the instructions contained within this guide. In no event shall Mimecast be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss), even if Mimecast has been advised of the possibility of such damages. As some US states do not allow the exclusion or limitation of liability for consequential damages, the above limitation may not apply to you. Requests, amendments and suggestions to documentation@mimecast.com

3 Table of Contents Chapter 1: Mimecast What is Mimecast? Data Center architecture Chapter 2: Mimecast Infrastructure Error! Bookmark not defined. What is Mimecast? Error! Bookmark not defined. Software-as-a-Service (SaaS) Mimecast Services Account Integration Options Chapter 3: Administrator Roles Roles Editor Security Permissions Application Roles Exercise: Administrator Roles Chapter 4: Track and Trace Troubleshooting Delivery Failed Delivery Outbound Inbound Delayed Delivery Outbound Inbound Proving Delivery Exercise: Track Delivery Chapter 5: Policy Management Inbound Lockout Permitted / Blocked Senders Policy Secure Receipt / Secure Delivery Policies Secure Connections Exercise: Implement Security Policies Chapter 6: Monitoring Sync Services Directory Synchronization Directory Failures Journaling Viewing Journal Queues Journal Issues

4 Exercise: Test Service Status Chapter 7: Undetected Potential Spam What is spam? Why did Mimecast accept the ? Exercise: Confirm Receipt Chapter 8: Changing ISP s / IP addresses Gateway Chapter 9: Attachment Handling MSO 4 Large File Send (LFS) Exercise: Implement Attachment Management Appendix: Knowledge Base and Resources Knowledge Base Training Courses Available Online Course Titles: Other useful links:

5 Chapter 1: Mimecast KBID10140 What is Mimecast? Mimecast delivers cloud-based management services, including Security, Archiving and Continuity. By unifying disparate and fragmented environments into one holistic solution that is always available from the cloud, Mimecast minimizes risk and reduces cost and complexity, while providing total end-to-end control of . Founded in the United Kingdom in 2003, Mimecast serves thousands of customers worldwide and has offices in Europe, North America, Africa, and the Channel Islands. Data Center architecture KBID10456 Mimecast infrastructure consists of two geographically dispersed data centers in each physical location. This provides not only load balancing of all processing and archiving, but also provides DR coverage in the event of a natural disaster. The Mimecast architecture is made up of layers of servers based on functionality: Processing Layer, Scanning Layer and the Archiving Layer. For this session, we are going to concentrate on the Archiving layer The Processing layer is the layer which makes up our customer front-end clusters. So for example, your account may reside on service37-us and 38-us; which together make up a front end cluster. The processing layer is responsible for the security and reputation checks, which are coupled with the Mimecast Mail Transfer Agent (MTA). Other activities performed at this layer include Policy application. Once reputation checks and the relevant policies have been applied, the processing layer hands the over to the scanning engines. The scanning servers run multiple technologies concerned with the scanning of s and attachments looking for spam, viruses and malware. If the passes the scanning process and no virus is detected, the message will be moved to the Storage or Archiving Layer. It is as this stage that the is archived and indexed for searching capabilities. Storage infrastructure is a key element of the Mimecast Grid. As outlined above, this is supported by triple redundancy - data is continuously replicated to primary, secondary and tertiary storage nodes at one location and then again at multiple geographic locations. This process protects data to such a degree that the Mimecast Grid is able to automatically heal and protect itself against data loss and corruption. The process is entirely proprietary and remains confidential to Mimecast. The use of continuous replication sets us apart from our competitors, most of whom only use a low level of mirroring or warm standby infrastructure - and that is a recipe for data loss in the event of an outage. 2

6 Software-as-a-Service (SaaS) Mimecast provides services from the internet, also referred to as the cloud, delivered through a SaaS model. In simple terms, this means that Mimecast will handle your data in a secure way, and deliver it to your existing infrastructure. The benefit of this SaaS model is that it is always accessible, 100% of the time, and all you need is an internet connection to access your s. The SaaS solution is made available through two physically separate data centers. In the event of infrastructure outage, s will continue to flow to the alternative data center. This event is completely seamless, and ensures 100% Continuity. 3

7 Mimecast Services KBID10086 The available service features will depend on your specific Mimecast service subscription. Mimecast's current service portfolio is outlined in the manual below, and shows which areas of management are included in each service. Service Security Continuity Archiving Mimecast UEM Enterprise Mimecast UEM Express Mimecast Security Mimecast Continuity Mimecast Archive Mimecast File Archive Add-On Account Integration Options A number of connections are available for use when Mimecast is implemented. These features may be enabled, if the organization requires the functionality, but not all elements are required in order to benefit from Mimecast services: Service Authorized Outbounds KBID10036 Description IP address origination points from which Mimecast accepts the organization s outbound s. Delivery Routes The mail server that Mimecast should deliver inbound s to. KBID10081 Directory Connections KBID10092 Synchronisation services to network directories, such as Microsoft Active Directory, using LDAP/LDAPS. Journaling KBID10235 Journal connectors are used to import internal communications from the server to the Mimecast archive. Note: These account services are explored in detail later in this module. 4

8 Chapter 3: Administrator Roles KBID10575 Roles Editor Administrator access to Mimecast is controlled by Security Permissions that are allocated to a Role. The Administrator address is added to the Role, which enables that Administrator to log in to the Console and access specific Application menus and perform certain tasks. Only those Administrators that have the necessary Security Permissions can access available Roles from the Accounts menu. By default, Mimecast creates 6 Roles, as seen in the screenshot below. Note: The default Roles cannot be modified or removed, and one Administrator cannot belong to more than one role. Use the New Role button to create a new Role, or right-click an existing Role, and use the contextual menu to duplicate the Role. New or duplicated Roles are listed in Italic text within the Roles list, and an Edit Role button is available to modify the Role. Security Permissions Each Role has Security Permissions, which determines if the Role can access or modify other user s Roles: Cannot Manage Roles: If an Administrator that belongs to this Role logs in, they will not see the Roles menu at all Manage Application Roles: The Administrator can access the Roles menu, and can modify the Application Menus that the Role will have access to. However, they will not be able to modify access to protected areas of Mimecast, where contents can be accessed. Manage Application and Protected Roles: The Administrator can access the Roles menu, and can modify Roles completely. This includes access to Application menus as well as access to protected areas of Mimecast, where the contents of s are available. 5

9 Application Roles Application menus are displayed at the top of the Administrator console. These menus can be made available to the Role using checkboxes for each menu. It is also possible to manage read/edit permissions, where applicable, to sub-menus. Protected areas of Mimecast, where contents can be accessed, are highlighted in red text. Note: If the Roles menu is not accessible, contact our support team: Exercise: Administrator Roles KBID10601 Navigate to Roles (if available) o Select the Account menu o Select the Roles menu Review existing Roles o Click the View Role button for the Basic Administrator Role o Review the Security Permissions for the Role o Review the Application menus available to the Role members Manage Role Administrators o Return to the Roles page o Click on the Basic Administrator Role text to open the Role o Click on the Add User to Role button o Select an address from the list o Click on the Basic Administrator Role o Right-click the address entry added earlier, and select Remove User from the list 6

10 Chapter 4: Track and Trace KBID s not being delivered, or being delayed in delivery, can cause end users a lot of frustration. Most Administrators will have received support calls where end users have either received a postmaster notification (NDR Non-Delivery Report), or when an has not been received. As an Administrator, it is crucial to be able to troubleshoot these queries, and determine why delivery was delayed or failed. Alternatively, for s that have been successfully delivered, having the ability to search for the in question and review the s headers and transmission details allows you to prove delivery or chains of custody. Troubleshooting Delivery Below are some of the typical helpdesk support queries, as well as details on how best to troubleshoot these: Why did I not receive an ? Why did the recipient not receive an I sent? Why did I receive this notification? Where is this ? Was an delivered, and when? Using the information available from the end user and Mimecast s viewers and queues can vastly decrease the amount of time spent determining what happened to an . It is important to note that Mimecast logs all connections whether successful or not. The available Mimecast viewers and queues are described below: 7

11 Viewer / Queue Description Knowledge Base Gateway Tracking Administrators are able to enter simple information ( address, domain or message ID) and perform a search across multiple viewers and queues from a single place. KBID10428 Monitoring Rejections Monitoring Connections Monitoring Bounces Monitoring Delivery Queue Monitoring Held Gateway Accepted Archive Search Displays messages that have been blocked by Mimecast in protocol. This means that the data has not been accepted by Mimecast, and therefore the message cannot be retrieved. Displays all connections made to your Mimecast account, which were not initially successful, and therefore not accepted. These s may subsequently have been accepted, depending on the reason for the initial temporary failure. Displays outbound and inbound messages that Mimecast has accepted but is unable to deliver. Bounced s are still available in the Mimecast Archive as the was initially accepted. Displays all s (inbound and outbound) waiting to be delivered by Mimecast. Mimecast will by default attempt to deliver these s to the recipient for up to 4 days (96 hours) or 30 retry attempts Contains s that have been held by Mimecast based on policy configuration (Content Examination, Message Scanning and Attachment Management policies). Held s will be listed in this queue and can be Reviewed, Released or Rejected by the Administrator. Alternatively if left, messages will be moved after 30 days. Accepted s are s that have been processed by Mimecast, but have not been Archived yet. This can take between 2 to 6 hours, and is also dependent on s being in their final state (i.e. delivered to the intended recipient), and being indexed and archived. Archive Search can be used to trace s and troubleshoot delivery. Depending on Administrator permissions, you will either be able to view the metadata of the or view both the content and metadata. KBID10200 KBID10059 KBID10039 KBID10324 KBID10122 KBID10013 KBID10032 Failed Delivery When delivery fails, a NDR should be issued from the sending mail server to the original sender. This NDR is in response to the SMTP error code produced by the recipient s mail server. In order to troubleshoot failed delivery, as much information as possible should be obtained regarding the sender and recipient s addresses, the date and time the was sent, and the NDR (if possible). delivery can fail for various reasons, including the content of the , size of an attachment, the sender s address or mail server s IP address. Once you have determined the reason for the failure, this will need to be addressed before the can successfully be retried and delivered. Troubleshooting failed delivery can be split into Outbound and Inbound s, and is detailed below: 8

12 Outbound For outbound failed s, the sender should always receive a bounce or NDR, which is how they would determine the delivery has failed. If Mimecast attempted to deliver the and this was rejected by the next hop mail server, then the end user would receive a Mimecast generated bounce message, and the failed delivery would be logged in the Bounce Viewer. For s where a Mimecast bounce was received, navigate to the Mimecast Bounce Viewer to confirm the details. If the bounce or failure occurred further along in the delivery path, the mail server attempting the delivery should generate a bounce message, and send this to the original sender of the . If the notification was received from another device, you can confirm that Mimecast has actually processed the and passed it on by navigating to Accepted (if recently sent) or Search. This allows the Administrator to confirm that Mimecast has processed and delivered the to the next hop, and assist in assessing where the breakdown occurred. Note: Mimecast Accepted s and Search viewers provide transmission details for each , and provide full delivery information including next hop mail server, and date and time of delivery completion. This is detailed below. Inbound KBID10330 For inbound delivery failures, the external sender of the will typically contact the recipient (one of your end users), and let them know that they are trying to unsuccessfully send them an . KBID1008 With failed delivery, there should always be a notification sent to the sender, which will detail the mail server who issued the failure and the failure code and/or reason. To confirm where the failure occurred, try and gather as much information about the failure, i.e. details regarding the NDR. To determine if Mimecast rejected the , navigate to Tracking or directly to the Rejection Viewer. Alternatively, the sender may receive a notification but it is not generated by Mimecast, perhaps even your internal mail server. In this instance, ensure if Mimecast has in fact processed and attempted delivery by searching for the message in Accepted s or the Archive, if for an older . This will help in determining if the point of failure occurred before or after the was processed by Mimecast. Delayed Delivery KBID10767 Another common end user query is for s that have not been received or delivered yet. There are multiple reasons that could result in a delay, which can also include failure that the end user is not aware of. An example of this could be a newsletter which they always receive every week which has not been received. More commonly, delayed s can be caused by a mail server being subjected to greylisting but not retrying after 1 minute, or s that have been placed on hold due to possible spam content. Troubleshooting delayed delivery can be split into Outbound and Inbound s, and is detailed below: 9

13 Outbound If your end user has sent an but it has not yet arrived at its destination, it is important to confirm if they have received a notification or not. If no notification has been received, ensure that the made it as far as Mimecast by searching in Accepted s or the Archive. If you can locate the in either of these repositories, you will then be able to prove that it was delivered to the next hop or mail server using the transmission data available. If you cannot locate the message in either of these locations, confirm if the is still in the Delivery Queue awaiting delivery. For those where a notification was received from Mimecast, access the Delivery Queue to determine if the is still on retry, and to get more information as to the cause of the delay. Possible reasons for a delay could be: spelling mistake for the address of the recipient, the recipient s mail server is down or recipient s DNS server is experiencing issues and not providing valid MX records. Inbound In this scenario your end user will be expecting an that has been delayed. There is also a chance that the delivery could have failed but the sender has not provided this information or the associated NDR. Navigate to Tracking to determine where the was delayed. It is important to note whether the was accepted by Mimecast and can be found in Accepted s or Search. If the has not yet been accepted, the attempt will be logged in Connections. Alternatively it could be that the has matched the configured spam scanning, attachment or content examination policies, and is in the users Hold Queue. They may have already received a notification regarding the quarantined message in the form of the digest which is sent out by Mimecast according to the schedule for your account. If the held, it can then be released and delivered to the intended recipient. Finally, if the has been rejected by Mimecast it can be viewed in the Rejection viewer. Proving Delivery You may need to access historic s to prove the delivery of an , for a legal request or to retrieve an which has since been deleted off your internal environment. Accepted s and Search allow you to locate an and determine additional information about the processing, delivery of the and the policies applied. Similar options and information are available for s in both Accepted s and Search. The metadata as well as the transmission information can be viewed, and if the Administrator has access Elevated privileges, the content can also be viewed. Mimecast also provides full details of all the policies applied to the . Receipt and Delivery events can be very helpful in determining why an was accepted by Mimecast or delivered respectively. 10

14 Exercise: Track Delivery Use the Tracking tool to locate s Log into the Mimecast Administration Console Navigate to the Gateway Tracking menu In the To address field, enter your address Leave the date range as is Click on the Search button Review the results, looking for various viewers s to you are located in Click on the items for more information Now perform the same search, but enter your address in the From field Use Search to prove delivery Navigate to Archive Search Configure the search parameters to include outbound s Select one of the outbound messages Select the destination address from the Receipt/Delivery View field Use the View menu to select the Delivery View Review the information in the Remote Server Information section KBID

15 Chapter 5: Policy Management KBID10583 By default, your Mimecast Account is configured with a standard set of Policies which are configured to provide optimal security and mail flow control. Some of these Policies include providing details where inbound s should be delivered, which attachments should be stripped from s, and what spam scanning settings should be applied to the content of s. Over and above this list, there are many other Policies that can be configured to control the way Mimecast processes and delivers s. As a result, you may periodically need to create new Policies or amend existing Policies. It is important to understand how policies are applied, and the affect they will have on the way Mimecast processes s. Some of the common queries regarding policy creation, and application tend to focus around these policy types: Inbound Lockout Permitted / Blocked Senders Secure Receipt / Secure Delivery Inbound Lockout KBID10332 The Inbound Lockout policy is designed to block unwanted inbound spoofed s, i.e. an inbound originating from the internet, but displaying the internal domain name; and directed to the internal end users. Mimecast recommends that customers configure an Inbound Lockout policy which will block any spoofed attempts. This policy can be created to ensure that traffic originating from the internet, but appearing to come from an internal domain, is not allowed inbound. Prior to adding any Inbound lockout policies, is it important to consider any legitimate spoofed traffic that should be allowed. This could include s generated from a website where the sender is info@internaldomain.com, or a payroll system that generates s from and to the end user, using their internal address. In this instance, a bypass policy can be created to allow s from certain IP addresses through, even though they may appear as typical spoofed s. All other spoofed s can be configured to be blocked and therefore rejected. Note: If a user has added their own address or one of the company internal domains to their Permitted senders list, this policy will be overridden by the lockout policy, as it is applied first. Permitted / Blocked Senders Policy KBID10475 Permitted and Blocked Senders policies allow you to control who is able to inbound to your organization (and in some instances outbound). If moving from another service, you can bring your Permit and Block lists with you. Mimecast allows import functionality for more complex lists, or these entries can simply be copied and pasted into the pre-configured groups which already exist in policies. When your Mimecast account is initially created, a Permitted and a Blocked policy is created which references an empty local profile group. To ensure specific addresses or domains are blocked or permitted, you can either create additional policies, or alternatively add addresses or domains to the existing groups. 12

16 End users are also able to control their own Personal permit or block policies: Enable the digest to be sent out to all end users. The Digest provides access to release s to their Inbox, as well as permit or block all future s from the actual sender By accessing Mimecast Personal Portal (MPP) and selecting the Managed Senders link. addresses or domains can then be added to their own personal permit or block list; or existing entries can be deleted Note: Administrators can also amend these Policies for their users from within the Administration console, under the Gateway Managed Senders menu. Secure Receipt / Secure Delivery Policies KBID10515 Transport Layer Security (TLS) security technology is designed to protect confidentiality and data integrity by encrypting messages between servers. This reduces the risk of eavesdropping, interception, and alteration. This graphical representation shows an outbound being sent securely through an end-to-end negotiated encrypted tunnel between the sender s mail server and Mimecast. Company A Secure receipt Secure delivery Company B There may be instances where you are required to send certain s via secure delivery or TLS. By default Mimecast will deliver all s using SMTP, however policies can be used to ensure this traffic is sent via TLS. There are basically two main options when configuring TLS: Deliver using TLS where possible Enforce TLS When using the TLS policies Secure Receipt and Secure Delivery, it is important to understand that the encryption policies are split between the traffic from the sender to Mimecast (Secure Receipt) and the traffic from Mimecast to the recipient (Secure Delivery). This applies to both inbound and outbound s. KBID10925 DNS Authentication This policy helps administrators to control the types of authentication checks that are performed when Mimecast receives an . SPF, DKIM, and DMARC are open standards for authentication, used to determine whether a message's sender and/or contents were forged. Each of these works by defining extra DNS records for the sending domain: 13

17 Sender Policy Framework (SPF) validates the connecting IP address by looking up the DNS record for the domain in the envelope MAIL FROM or HELO/EHLO. It can tell you whether the IP connecting to Mimecast is permitted to send mail for that domain Domain Keys Identified Mail (DKIM) validates the contents of the message body and headers by creating a cryptographic hash (or signature), and adding it as a new header to the message. It confirms that the message's content was sent from a specific domain by matching the signature to the DNS records by verifying the signature using the DNS record published by the sending domain Domain-based Message Authentication, Reporting and Conformance (DMARC) connects the domain verified by SPF or DKIM to the domain in the FROM header of the message. DMARC also provides other features, which are not relevant to this article. Mail Transfer Agents (MTAs) can verify SPF, DKIM, or DMARC for inbound s if the sender publishes DNS entries for them in their domain records. Secure Connections KBID10670 Connections to and from Mimecast can also be secured in a number of ways. These options are explored in further detail within the Mimecast Security training module, and a summary of the options can be seen in the table below: Connection Type SMTP (TLS) POPS LDAPS Applies to Inbound/Outbound mail; SMTP Journaling POP3 Journaling Active Directory Connections Exercise: Implement Security Policies Create an Inbound Lockout exclusion policy based on Source IP address o Log into the Mimecast Administration Console o Navigate to the Gateway Policy Editor (Gateway Policies) o Select Inbound Lockout from the available list o Create a new Policy o Specify Everyone as the sender ( From and your internal address as the recipient ( To) o Enter the IP addresses in the Source IP address box o Ensure that the Policy Override checkbox is selected Create a policy to attempt to deliver TLS where possible for outbound s between Mimecast and domain abc.com (i.e. the traffic will be delivered through normal SMTP from your environment to Mimecast, but encrypted where possible from Mimecast to the recipient domain) o Log into the Mimecast Administration Console o Navigate to the Gateway Policy Editor (Gateway Policies) o Select Secure Delivery from the available list o Create a new Policy o Select the drop down option Secure SMTP where possible o Specify Internal as the sender and Domain (abc.com) as the recipient 14

18 Chapter 6: Monitoring Sync Services KBID10503 To enhance your experience with Mimecast, Directory Synchronization and Journaling can be implemented. To use these services, you are required to open certain ports and configure various settings/accounts in your internal environment, so that Mimecast can connect to sync this information. Mimecast monitors these services, but also provides a monitoring and alerting system called Service Monitor. This tool allows Administrators to configure thresholds and alerts so that they are able to proactively respond to any potential issues affecting both queues and synch services. There may be certain instances where these sync services fail. It is important for Administrators to be aware of the troubleshooting steps that should be taken to ensure these sync services are restored as soon as possible. See below for more information about these services and the steps to be followed to troubleshoot connectivity. Directory Synchronization Directory Synchronization allows for the use of additional functionality including: Synching of attributes which can be used in policies or stationery pieces Providing administrators and users to login to Mimecast using their network credentials Synching of groups which can be used in Policies KBID10092 Directory Failures There are certain instances where the sync process may fail, which can result in end user logins failing, as well as permission issues. Prompt resolution of directory sync issues ensures that Mimecast end users can continue to login successfully. The two main common issues are: Directory connection credential failure Directory connection connectivity failure When attempting to resolve a directory connection issue, an Administrator should always initially confirm whether any changes have been made to the infrastructure or devices, or if there are any known issues that may prevent successful connectivity. Viewer / Queue Description Credential Failure Has the Active Directory account been moved or deleted? Has the password for the Active Directory account been modified or reset? Is the Active Directory account still active and not expired or locked out? Knowledge Base KBID10428 Connection Failure Are there any connection issues that have arisen at your infrastructure? Have any changes been made recently to your Company firewall? Is the LDAP service currently running on your Directory Server? Is using LDAPS, has your certificate expired? KBID

19 Journaling Journaling is the process that allows Mimecast to retrieve/accept internal s from your mail server, KBID10235 to provide a full archive of both internal and external s. Journaling can be achieved using either SMTP Journaling (push) or POP3 Journaling (pull). Viewing Journal Queues To view the current list of Journaling items, navigate to Services Journaling, and select the Queue Details button. For Exchange Envelope Journal Format (EJF), the actual recipient is displayed as the sender, and the journal address as the recipient. Journal Issues There are certain instances where the journaling process may fail, and this section is designed to assist in troubleshooting these journaling issues. Failure to extract/deliver messages from a journal mailbox can have a severe impact on the internal environment s information store and on the performance of the mail server, and should therefore be investigated immediately. Prompt resolution of journaling issues ensures that Mimecast can continue to successfully archive internal messages. Typical reasons for a journal failure include: Journal credential failure Journal connection failure When attempting to resolve a journal issue, an Administrator should always initially confirm whether any changes have been made to the infrastructure or devices, or if there are any known issues that may prevent the successful extraction/delivery of Journal information between the remote infrastructure and Mimecast. Viewer / Description Queue Credential Failure Has the Active Directory account been moved or deleted? Has the password for the Active Directory account been modified or reset? Is the Active Directory account still active and not expired or locked out? Knowledge Base KBID1042 Connection Failure Are there any connection issues that have arisen at your infrastructure? Have any changes been made recently to your Company firewall? Is the LDAP service currently running on your Directory Server? Is using LDAPS, has your certificate expired? Have there been any IP address changes Has the Journal domain been added to Mimecast (if SMTP Journaling) KBID

20 Exercise: Test Service Status KBID10671 Test your Directory Synchronization Connection to ensure it is synching successfully Log in to the Administration Console o Navigate to Services Directory Sync o Click on Synchronize LDAP Data o Wait for the directory synchronization to complete o Review the results page Test your Journaling (if POP3) o o o o o Navigate to Services Journaling Open the applicable journal connector Click on the Test Journal Extraction button Wait for the for a text extraction to complete Review the results page Review your Journaling Connection (if SMTP) o o o Navigate to Services Journaling Open the applicable journal connector Review the Service Status results at the bottom of the page 17

21 Chapter 7: Undetected Potential Spam KBID10319 What is spam? Administrators will inevitably deal with support calls regarding spam s being delivered to end users. It is important to note that spam means different things to different people. Some consider any unwanted as spam (even if they asked for it but don t want it anymore). Some consider all bulk s (newsletters and marketing announcements) to be spam. While others consider any from people they don t know to be spam. In order to deal with spam effectively, remember that spam is anonymous, unsolicited, bulk . Why did Mimecast accept the ? To troubleshoot potential spam s, review the steps below: Confirm if the is in fact spam or something that has been subscribed to. If you have a copy of the message, confirm if the has a legitimate unsubscribe link, as this will also give you a clue as to whether the is actually spam. Confirm that the was not an that was held by Mimecast spam scanning policies and then released by the end user Check the receipt event for the . For every inbound that Mimecast accepts, there is an associated Receipt Event. This receipt event represents the reason why Mimecast accepted the and is typically based on a policy. For s that are accepted based on a permit list, autoallow list or as a manual permitted sender, the content is not scanned for spam. Review the Spam scanning settings policy. The policy can be set to 3 different levels: Relaxed, Moderate or Aggressive. If you are concerned that too much potential spam is being delivered to users Inboxes, try increasing the level to Moderate or Aggressive. Monitor the results to ensure that this does not lead to false positives. If deemed to be spam, submit spam examples to spam@mimecast.org - In order to submit examples, forward the as an attachment. This allows the Mimecast Security team to review the actual and its contents, and determine if changes need to be made to our spam scoring settings. Note that the Security team will not necessarily respond to each , but use these examples to analyse new spam techniques and trends. 18

22 Exercise: Confirm Receipt Check the Receipt event for an inbound Log in to the Administration Console Navigate to Archive Search Click on an Inbound Select the recipient address from the Receipt/Delivery View field Click the View menu, and select Receipt View Look at the Receipt Event to determine why Mimecast accepted the KBID

23 Chapter 8: Changing ISP s / IP addresses There may be instances when your public IP address range changes due to an ISP change, or network alteration. If so, you will also need to change the applicable IP address information stored within Mimecast. It is important to plan these changes in advance and contact Mimecast Support to discuss. Most changes can only be made once the new IP addresses are in place. Settings and Policies that refer to your IP addresses include: Configuration Option Description What Needs To Be Changed Knowledge Base Outbound The only IP address/es that Mimecast will accept outbound s from Contact Mimecast support to add the new IP addresses prior to the stopover date (this can be done prior to the changeover) KBID10428 Delivery Routes Typically used to deliver s from Mimecast inbound to your local infrastructure (using Host Name or IP Address of the server) Delivery Route definition should be amended to reflect new IP addressing scheme KBID10200 Directory Sync A link using LDAP(s) between Mimecast and the customer Domain Controller. Amend the IP address field in the Directory connection. KBID10059 Journaling Provides access to upload internal s using either POP3 or SMTP journaling POP3 update the IP Address field SMTP update the Source IP address range field KBID10039 Note: Ensure that the delivery route definition is never renamed as Mimecast uses the name of the route to deliver the s to the correct IP address. All these changes need to be planned ahead and tested after the IP addresses have been updated. Gateway KBID10928 Mimecast is now inviting existing customers to move to our latest mail gateways. In 2010, Mimecast started a major project to develop a new mail gateway which would offer extended features, better performance, and more effective scaling. The resultant gateway has been in production since the start of 2012, and at the time of writing (June 2013), more than 20% of our customers are using this platform for all of their inbound and outbound mail processing. With the new gateway attaining mainstream status, Mimecast has moved the legacy mail gateway into a sunset phase to indicate that future enhancements will be available only on the new gateway. Once all customers have successfully migrated, we will retire the legacy mail gateway and from this point on, further changes to the legacy gateway will be limited to essential maintenance. 20

24 Chapter 9: Attachment Handling KBID10489 Mimecast offers multiple options to assist with managing attachments. This includes managing the type of attachments that are allowed, as well as the sizes of attachments. This can either be done for all attachments, or alternatively configured specifically for different attachment types. By default, Mimecast creates a standard Attachment Management policy to strip all dangerous attachment types from s (e.g. exe, bat files) both inbound and outbound. Administrators can extend these capabilities by creating different attachment policies for different groups or individuals, as well as adding to the default list of denied attachment types. Within the Attachment Set definition, you are also able to choose to strip, hold or link individual specific attachment types. As encrypted archives and documents cannot be interrogated, these attachments can be configured to be held in the Administrative hold queue to be reviewed, and if required, released. Additionally Mimecast has pornographic scanning options which can be enabled and set to various levels of probability. Policies which can be used to manage attachments: Viewer / Queue Attachment Sets Attachment Management Attachment Link on Size Attachment Block on Size Stripped Attachments Description Attachment Sets can be used to apply granular attachment handling for individual attachment types. Attachments can be limited by size, held for review, or stripped and linked to s as appropriate In order to implement attachment controls, the Attachment Set Definition must first be created, and then the Attachment Management policy needs to be configured to dictate the route of traffic that the Attachment Set should be applied to. Attachment Link on Size (also known as Strip and Link) allows Administrators to specify an attachment size limit, while still allowing end users to receive attachments over a certain size. The Attachment Block on Size Policy can be used to set restrictions on the maximum attachment size for s both inbound and outbound Any attachment that is blocked or stripped and linked from an , based on Mimecast Attachment Policies, is logged and available for release by an Administrator using Stripped Attachments. Knowledge Base KBID10219 KBID10489 KBID10184 KBID10176 KBID10297 MSO 4 Large File Send (LFS) Large File Sending (LFS) enables you to send large files directly through Mimecast when composing s in MSO4, bypassing the organization's server. An sent using LFS is delivered as a notification to the recipient, and includes a link to download the attachment. An additional notification is also delivered to the recipient with the access key to access the location 21

25 Exercise: Implement Attachment Management KBID10673 Create an Attachment Management Definition and Policy Log into the Mimecast Administration Console Navigate to the Gateway Policy Editor (Gateway Policies) Select the Definition button for the Attachment Management Policy Click on the New Attachment Definition button Complete the Definition fields as follows: o Description: Training Attachment Management Definition o Notifications: Internal Recipient o In the file list, check the Link box and specify the size of 1 Kb for docx extensions o Click on the Save and Exit button Click on the Go Back button Click on the Attachment Management Policy Click on the New Policy button Complete the Policy fields as follows: o Narrative: Test Attachment Management Policy o Policy Option: Select the Training Attachment Management Definition o s From: Change the Everyone option to External Addresses o s To: Change the Everyone option to Individual Address o The screen refreshes to display the Specifically field. Add your personal internal address in this field Click the Save and Exit button Send a docx file to your internal address from an external address as an attachment Navigate to the Monitoring menu select Attachments Right-click the attachments that was stripped, and select Release Attachment. 22

26 Appendix: Knowledge Base and Resources Knowledge Base This manual refers to several Knowledge Base (KB) articles which can be directly accessed by replacing the relevant ID number in the URL: Where xxxxx represents the ID of the article. To access the Knowledge Base, use the direct link: Training Courses Visit our website to view the latest information on our available training courses: KBIDxxxxx Available Online Course Titles: Available Classroom Course Titles: Mimecast Product Overview Mimecast Account Tour Mimecast Continuity Mimecast Security Mimecast Archiving Mimecast Admin Tasks Mimecast Exchange Tasks Mimecast Stationery Mimecast Admin Tasks Mimecast Service Management Mimecast Power Tools Mimecast Stationery Management Other useful links: Mimecast Community: Mimecast TV: Mimecast Blog: Mimecast Twitter: 23