Office 365 Standalone Security

Size: px

Start display at page:

Download "Office 365 Standalone Security"

Primrose Dina Gilbert
5 years ago
Views:

1 The standalone Security option is available for purchase only through the Barracuda Self-Service Gateway or Barracuda MSP. Once you complete the Essentials for Office 365 Wizard, the Essentials page displays in Barracuda Cloud Control. Click Set up additional domains to go to the Barracuda Security Service Domains page, or continue with your configuration. BARRACUDA SECURITY SERVICE Step 1. Set Up User Accounts You can add users manually, or use LDAP or Azure AD authentication to automatically synchronize the Barracuda Security Service with your active directory server. To create a few test accounts during the evaluation period, use the Manually Add Users steps. Manually Add Users Click to manually add users Go to Users > Add/Update Users: 2. In the User Accounts field, enter each user address for the domain on a separate line, and then select from the following options: 1. Enable User Quarantine All s for the user which meet the configured block policy go to the user's quarantine account. Depending on how you have configured the quarantine notification interval on the Users > Quarantine Notification page, the user receives a quarantine digest at a specified time. From the Users > Quarantine Notification page you can also enable the user to set their own quarantine notification interval Notify New Users When set to Yes, users receive a welcome once the account is created. Click Save Changes. The users are added to the Users > Users List table where you can select from the following actions: 1. Edit Click to specify domains this user can manage. 2. Reset Click to send the user an with instructions on how to reset their account password. 3. Log in as this user Click to view or change the user's settings (for example, quarantine notifications), view/manage the domains this user manages, and v iew/search/manage the user's Message Log. 4. Delete Click to remove the user account. 1 / 13

The first time the Barracuda Email Security Service receives an Allowed email for a non-existent user at a domain configured for the service, if that same recipient receives a second email 1-6 days

This method of new account creation does not use LDAP lookup, and the user receives an email from the Barracuda Email Security Service with their login information so they can access their quarantine

2 The first time the Barracuda Security Service receives an Allowed for a non-existent user at a domain configured for the service, if that same recipient receives a second 1-6 days later, a new user account is created. This method of new account creation does not use LDAP lookup, and the user receives an from the Barracuda Security Service with their login information so they can access their quarantine account. Automatically Add Users You can configure user authentication via your organization's LDAP server or Azure AD service. For complete setup details, see the following articles: How to Configure User Authentication with Azure AD How to Configure User Authentication Using LDAP Step 2. Add Additional Domains Use the steps in this section only if you want to manually add additional domains, otherwise, go to Step 3. Create Transport Rule. Click to add additional domains... Obtain the hostname: 1. Log in to the Office 365 admin center. 2. In the left pane, click Settings > Domains. 3. In the Domains table, click on your domain. 4. Take note of the hostname. This is the address of your destination mail server, for example, cudawarecom.mail.protection.outlook.com 2 / 13

3 Enter the hostname: Barracuda recommends using a hostname rather than an IP address so that you can move the destination mail server and update DNS records without making changes to the Barracuda Security Service configuration. This address indicates where the Barracuda Security Service should direct inbound mail from the Internet to your Office 365 Exchange server. For example, your domain displays to the Internet as: bessdomain.mail.protection.outlook.com 1. Log in to the Barracuda Security Service as administrator, and click Domains, and click Add Domain. 2. Enter the domain name and destination mail server hostname obtained from your Office 365 account in the dialog box. 3. Click Add; the Domain Settings page displays. Step 3. Create Transport Rule Log in to the Office 365 admin center, and go to Admin centers > Exchange. In the left pane, click mail flow, and click rules. Click the + symbol, and click Bypass spam filtering: 4. In the new rule page, enter a Name to represent the rule. 5. From the Apply this rule drop-down menu, select The sender > IP address is in any of these ranges or exactly matches: 3 / 13

4 6. In the specify IP address ranges page, type the IP address range for the Sender (Barracuda Security Service) based on your Barracuda Security Service instance, for example, type: /20, and click the + symbol. 7. Type the next IP address range for the Sender, for example, type /21, and click the + symbol: 8. Click OK. 9. Click Save. The list of mail flow rules displays. 10. Select the rule you just created, and click the edit icon to display the properties. 4 / 13

5 Scroll to the bottom and change the Priority of the rule to 0. This ensures it is the first rule to process. Click Save. Step 4. Restrict Inbound Mail to the Barracuda Security Service IP Range (Optional) Important: After updating your MX records, allow 24 hours before completing the steps in this section to allow the records to propagate. Use the following steps if you want to restrict inbound mail to the Barracuda Security Service IP address range: Click to restrict inbound mail Log in to the Office 365 admin center, and go to Admin centers > Exchange. 2. In the left pane, click mail flow, and click rules. 3. Click the + symbol, and click Create a new rule. 4. In the new rule page, enter a Name to represent the rule. For example, type: Barracuda ESS IP restriction 5. Scroll down and click More Options. 6. From the Apply this rule if drop-down menu, select The Sender > Is External/Internal > Outside the organization. 7. From the Do the following drop-down menu, select Reject this message with the explanation. 8. Enter the message you want included in the non-delivery report (NDR) that is sent to the sender. For example, enter: You have attempted to bypass our Security Service. Please ensure your DNS is up-to-date and try sending your message again. 9. Click Add Exception. 10. Select The Sender > Sender s IP address is in any of these ranges or exactly matches, and enter the Barracuda Security Service IP range based on your Barracuda Security Service instance Enter the Barracuda Security Service IP range, for example: /20 Click the + symbol. Enter the Barracuda Security Service IP range, for example: /21 Click the + symbol. Click OK. Select Stop processing more rules. Under Match sender address in message, select Envelope. Click Save. The list of mail flow rules displays. Select the rule you just created, and click the edit icon to bring up the properties. Scroll to the bottom and change the Priority of the rule to 0. This ensures it is the first rule to process. Click Save. If you complete both Step 3. Create Transport Rule and Step 4. Restrict Inbound Mail to the Barracuda Security Service IP Range, verify the Restrict Inbound Mail from Outside Your Organization to the Barracuda Security Service IP Range rule displays first in the mail flow rules list, and the Transport Rule rule displays second in the mail flow rule list. 5 / 13

6 Step 5. Configure Outbound Mail If you have multiple domains within your Office 365 tenant and you want to scan only certain domains outbound, see How to Configure Office 365 to Scan Only Selected Domains Outbound. If you have not already done so, contact Barracuda Technical Support and request that Outbound Groups be enabled on your Barracuda Security Service account Log in to the Barracuda Security Service, click Domains, and click on the domain name to toggle the MX Records configuration; make note of the Outbound Hostname. Log in to the Office 365 admin center, and go to Admin centers > Exchange. In the left pane, click mail flow, and click connectors. Click the + symbol and use the wizard to create a new connector. 5. From the From drop-down menu, select Office 365, and from the To drop-down menu, select Partner organization: 6. Enter a Name and (optional) Description to identify the connector: 6 / 13

7 7. Click Next. Select Only when messages are sent to these domains, click the + symbol, and enter an asterisk (*) in the add domain field: 7 / 13

8 8. Click OK, and click Next. Select Route through these smart hosts, and click the + symbol. 9. Go to the Barracuda Security Service, click the Domains tab, and click on the domain name to toggle the MX records configuration. Copy your outbound hostname, and enter it in the add smart host page: 8 / 13

9 10. Click Save, and click Next. Use the default setting, Always use Transport Layer Security (TLS) to secure the connection (recommended) > Issued by Trusted certificate authority (CA): 9 / 13

10 11. Click Next. In the confirmation page, verify your settings and click Next. Office 365 runs a test to verify your settings: 10 / 13

11 12. When the verification page displays, enter a test address, and click Validate. Once the verification is complete, your mail flow settings are added. For additional configuration options and features, log in to the web interface and click Help. Step 6. Configure Sender Policy Framework for Outbound Mail To assure Barracuda Networks is the authorized sending mail service of outbound mail from your Barracuda Security Service, add the following to the Sender Policy Framework (SPF) record INCLUDE line of the SPF record for your sending mail server for each domain sending outbound mail. Select the relevant SPF INCLUDE based on the region you selected for your Barracuda Security Service. For example, if you are using Office 365, your record would look similar to: v=spf1 include:spf.protection.outlook.com include:spf.ess.barracudanetworks.com -all See Sender Authentication for more information. If you have an SPF record set up for your domain, edit the existing record, and add the following to the INCLUDE line for each domain sending outbound mail based on your Barracuda Security Service instance. For example: include:spf.ess.barracudanetworks.com -all If you do not have an SPF record set up for your domain, use the following value to create a TXT record that creates a HARDFail SPF for your domain based on your Barracuda Security Service instance. For example: v=spf1 include:spf.ess.barracudanetworks.com -all See Sender Policy Framework for Outbound Mail for INCLUDE values based on your Barracuda Security 11 / 13

12 Service instance. 12 / 13

13 Figures 13 / 13

To create a few test accounts during the evaluation period, use the Manually Add Users steps.

To create a few test accounts during the evaluation period, use the Manually Add Users steps. Once you complete the Essentials for Oﬃce 365 Wizard, the Essentials page displays in Barracuda Cloud Control. Click Set up additional domains to go to the Barracuda Email Security Service Domains page,