How to configure Sophos for all other clients

Size: px

Start display at page:

Download "How to configure Sophos for all other clients"

Wilfrid Joseph
5 years ago
Views:

1 How to configure Sophos for all other clients 1. Add Your Domain & Verify Ownership 2. Add Mailboxes to Sophos 3. Restrict Delivery to Sophos IP Addresses 4. Modify MX records to point to Sophos 5. Test and confirm mail flow Add Your Domain & Verify Ownership You will need to provide the following information when configuring Sophos to process and deliver for your domain: Your domain name The port number that is used to listen for SMTP traffic on the mail delivery destination host To add a domain in Sophos Central: 1. Log into Sophos Central Admin Console 2. Go to System Settings 3. Under Security, click Settings 4. On the Settings page, click Add Domain 5. Enter your domain 6. For delivery destination and port, enter the FQDN or IP for your mail server on Port Next, click Verify Domain Ownership 8. Copy the TXT value presented in the Verify Domain Ownership dialog this value is specific to your domain

2 9. Create a TXT DNS record in the root level of the domain name (entered in Step 5) and paste the TXT value that was copied in the last step. You can give it the same TXT name as shown or 10. Once the new TXT DNS record entry has been saved, click Verify NOTE: Once the DNS update with the correct TXT value has been propagated, a message will be returned indicating that the domain verification was successful. Success: Failure:

3 If the DNS update has not yet propagated, or if the value entered is incorrect, a failure message will be returned. Confirm that the value entered is correct and/or wait a little longer to complete the domain verification process. Add Mailboxes to Sophos There are 3 ways to add users/mailboxes to Sophos Central: 1. Automatically via Active Directory Sync 2. Manually via the UI 3. Manually via.csv import NOTE: Support for Azure Active Directory Sync is not yet available. Office 365 customers can import or manually create mailboxes in the UI until Azure AD Sync is available. Adding users/mailboxes via AD Sync: Before you can set up synchronization, you need.net Framework 4.5 or higher on the computer where you will run the Sophos Cloud Active Directory Synchronization Utility. To set up synchronization with Active Directory: 1. On the Active Directory Sync Status page, click the link to download the Sophos Cloud Active Directory Synchronization Utility installer, and then run it. 2. In the setup wizard, enter the information required. On the last page, select the Launch Sophos Cloud AD Sync Utility checkbox and click Finish. Alternatively, go to the Windows Start menu > All Programs > Sophos > Cloud > AD Sync. If you are running Windows 8 or later, in the Apps list, find the app AD Sync listed under Sophos. Follow the instructions in the Sophos Cloud Active Directory Synchronization Setup wizard.

4 3. On the Cloud Credentials page, enter your Sophos Central account credentials. 4. On the AD Configuration page, specify your Active Directory LDAP server and credentials for a user account that has read access to the entire Active Directory forest with which you want to synchronize. To stay secure, use an account with the least rights that will give this access. We recommend that you use a secure LDAP connection, encrypted via SSL, and leave the Use LDAP over an SSL connection checkbox selected. If, however, your LDAP environment doesn t support SSL, clear the Use LDAP over an SSL connection checkbox and change the port number accordingly. Usually, the port number is 636 for SSL connections and 389 for insecure connections. 5. If you don t want to synchronize the entire forest, on the AD Filters page, you can specify which domains to include in the synchronization. You can also specify additional search options search bases and LDAP query filters for each domain. Distinct options can be specified for users and groups. Note: AD Sync will only create groups that have members which include discovered users, regardless of group filter settings. o Search bases You can specify search bases (also called base distinguished names ). For example, if you want to filter by Organizational Units (OUs), you can specify a search base in this format: OU=Finance,DC=myCompany,DC=com o LDAP query filters To filter users, for example, by group membership, you can define a user query filter in this format: memberof=cn=testgroup,dc=mycompany,dc=com The above query will limit user discovery to users belonging to testgroup. Note that unless a group query filter is also specified, AD Sync will discover all groups to which these discovered users belong. If you wish group discovery to also be limited to testgroup, you could define the following group query filter: CN=testGroup Important: If you include base distinguished names in your search options or change your filter settings, some of the existing Sophos Central users and groups created during previous synchronizations may fall outside the search scope and may be deleted from Sophos Central.

5 6. On the Sync Schedule page, define the times at which the synchronization will be performed automatically. Note: A scheduled synchronization is performed by a background service. The AD Sync utility does not need to be running for the scheduled synchronizations to occur. If you want to synchronize manually by running the AD Sync utility and don't want the synchronization to run automatically on a regular basis, select Never. Only sync when manually initiated. 7. To synchronize immediately, click Preview and Sync. Review the changes that will be made during the synchronization. If you are happy with the changes, click Approve Changes and Continue. The Active Directory users and groups are imported from the Active Directory to the Sophos Central Admin console. To stop the synchronization in progress, click Stop. Adding a mailbox manually: Sophos allows you to add single mailboxes manually via the user interface. To add a mailbox manually: 1. Click on Mailboxes in the left hand navigation 2. On the Mailboxes screen, click the Add Mailbox button in the upper right. 3. Select the Add Mailbox option 4. Select a Mailbox Type. Types are User, Distribution List or Public Folder.

6 5. Enter a Name for the Mailbox, Distribution List or Public Folder 6. Enter the SMTP address for the Mailbox. 7. Click Save to create a single mailbox and exit, or Save and Add Another to create additional mailboxes. Adding Mailboxes via Import: Sophos allows you to add mailboxes in bulk mailbox import. To add import mailboxes: 1. Create your import.csv file using the following format: 2. Click Add Mailbox and select Import Mailboxes. 3. Click Browse and navigate to your import file. 4. Click Add to start the import process. 5. Import will run and display results after it completes: To verify mailbox creation, you can search for new users in the People section or browse the list of mailboxes under the Mailboxes section for Distribution Lists and Public Folders. Restrict Delivery to Sophos IP Addresses NOTE: Before you proceed, we strongly recommend testing mail flow and domain configuration in a non-production/test environment prior to making any changes to the mail flow for your company. In order to add an additional level of security to the integration between Sophos and your mail host, we recommend that you configure the connection to your mail host to be restricted to our delivery IP s.

7 The specific delivery IP that you will need to use is tied to the region in which your Sophos Central account is hosted. When your Sophos Central account was created, you would have chosen to store your data in the United States, Germany, or Ireland. Region US Germany Ireland IP s NOTE: Using an IP other than the one specified for your region will prevent mail from flowing properly. Modifying MX Records to Point to Sophos Modifying your domain MX records to point to Sophos is crucial to the successful deployment of the solution and ensures all is filtered and delivered. If you do not have the ability to make these changes yourself, it will be necessary to contact your IT department, hosting provider, ISP or Domain Name Service provider and arrange for the MX records for your domain(s) to be modified. When you created your Sophos Central account, you selected a region in which you wanted to store your data. Your MX records are dependent on this region. Modify your MX records to include the record names associated to the region that you chose to store your data in. Region United States Germany Ireland MX Records 10, mx-01-us-west-2.prod.hydra.sophos.com 20, mx-02-us-west-2.prod.hydra.sophos.com 10, mx-01-eu-central-1.prod.hydra.sophos.com 20, mx-02-eu-central-1.prod.hydra.sophos.com 10, mx-01-eu-west-1.prod.hydra.sophos.com 20, mx-02-eu-west-1.prod.hydra.sophos.com Please take care with all options to ensure that the spelling and numbers are correct. Also, using MX record names other than those provided will prevent mail from flowing properly. Lastly, it is always recommended when changing DNS entries like MX records to lower the TTL (to 600 ms or less) on the records well in advance of updating the entries. This will allow the change to propagate in minimum time and provides a quick way to revert the change should there be any issues encountered during testing.

8 Test and confirm mail flow Once you have updated your MX records, you will want to send a test message to any mailbox that is protected by Sophos . For a true test, you should send your test message from an address outside of your domain. To confirm that the message flowed through Sophos , you can view the Message History Report. To access the report: 1. In Central, click on Reports & Logs. 2. Scroll down to the bottom of the page 3. Under Protection, click Message History 4. If messages are flowing through the system, you will see entries in this report. If mail is not flowing, meaning you are not receiving to your test inbox, take the following steps: 1. Verify that your MX records are correct for your region. 2. Verify that you set up the Sophos Delivery IP s correctly in your gateway, firewall or connector. 3. Verify that the mailbox that you are sending to exists in Sophos . If you have taken all these steps and mail is still not flowing for your domain, you should contact Sophos Support.

SafeConsole On-Prem Install Guide

SafeConsole On-Prem Install Guide This guide applies to SafeConsole 5.0.5 Introduction This guide describes how to install a new SafeConsole server on Windows using the SafeConsole installer. As an option,