Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

How to set up rules so Exchange only receives mails from MxLogic servers?

Posted on 2011-03-22
11
Medium Priority
?
945 Views
Last Modified: 2012-05-11
Hi Experts,

We use McAfee's MxLogic email protection to have them filter our mails before delivered to our Exchange server. The first couple weeks, it did a really good job. But later, junk emails probably figure out how to send emails directly to our Exchange server so now we need to lock down our Exchange server or set up firewall rules to ensure that only filtered mail from McAfee will be delivered to our Exchange server.
Can you tell me how to do that in our ASA?
 
0
Comment
Question by:Castlewood
  • 4
  • 4
  • 3
11 Comments
 
LVL 79

Accepted Solution

by:
lrmoore earned 1000 total points
ID: 35189601
Setup an in bound acl that only accepts mail from trustes sources. You probably have a rule now to accept smtp from "any"

Change this:
 access-list outside_access_in permit tcp any host a.b.c.d eq 25

To this:
 access-list outside_access_in permit tcp host <mxlogic> host a.b.c.d eq 25
 no access-list outside_access_in permit tcp any host a.b.c.d eq 25

Done.
0
 
LVL 33

Assisted Solution

by:MikeKane
MikeKane earned 1000 total points
ID: 35189612
Setup an ACL on your outside interface so only approved IPs can send traffic inbound to port 25 SMTP.  

You should already have an ACL on the outside, so you just need to add a few lines to it.  


access-list acl_out extended permit tcp host <ip of MxLogic> host <your email server public ip> eq smtp
access-list acl_out extended permit tcp host <ip2 of MxLogic> host <your email server public ip> eq smtp
access-list acl_out extended deny tcp any host <your email server public ip> eq smtp

This will allow the MxLogic server to speak with your email's public ip, then deny all other hosts.  

0
 
LVL 79

Expert Comment

by:lrmoore
ID: 35189616
Also, make sure you only have one MX record for your domain, and that it points to MXLogic and not to your own public IP address a.b.c.d. You may have a secondary MX record that goes straight to you and that is where spammers will always hit first. They don't go to the primary MX host, they go for the second or third.
0
Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

 
LVL 79

Expert Comment

by:lrmoore
ID: 35189625
We must have been typing at the same time, Mike!
0
 
LVL 33

Expert Comment

by:MikeKane
ID: 35189660
Yep - I think so.   Wouldn't be the 1st time.

And I was about to add that part about the 2nd MX record also.     Good call.
0
 

Author Comment

by:Castlewood
ID: 35190029
Thank you for your prompt reply. You guys are awesome.
One thing though, we have some iPads/iPhones directly connecting to our Exchange server for getting emails. Do they use SMTP? Would this rule block those iPads users from accessing our Exchange server?
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 35190202
Depends. If they use OWA, or direct push then should be no problem. If they use POP3, then maybe unless you set them up to use a different outgoing smtp server or require authentication. Or have them use the VPN to access Exchange.
We might need some Exchange expertise to pop in . . .  
0
 

Author Comment

by:Castlewood
ID: 35190685
Mike,
in your commands, you have the deny command:
access-list acl_out extended deny tcp any host <your email server public ip> eq smtp

Would this deny command void the two Permit commands and block all smtp traffic from accessing to my Exchange server ?
0
 
LVL 33

Expert Comment

by:MikeKane
ID: 35190815
Access lists are evaluated from the top down, as soon as the ACL finds a match, the processing stops.   So the allowed servers would match (traffic allowed) and the ACL never even evaluated the Deny statement.    The ACL as a whole will allow your mxLogic boxes and deny all else.  

>>some iPads/iPhones directly...
Normally, these devices use EWS to get mail from exchange over SSL.   I would really discourage you from opening POP ports into your exchange when you have OWA and EWS as an available and more secure alternative.
0
 

Author Closing Comment

by:Castlewood
ID: 35200557
I tested and found iPad has no issue receiving from my 2003 Exchange. iPad got to be using different protocol.
0
 

Author Comment

by:Castlewood
ID: 35201457
I tested and found iPad has no issue receiving from my 2003 Exchange. iPad got to be using different protocol. BUT cannot send out since iPad use SMTP to send emails.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many of the companies I’ve worked with have embraced cloud solutions due to their desire to “get out of the datacenter business.” The ability to achieve better security and availability, and the speed with which they are able to deploy, is far grea…
During and after that shift to cloud, one area that still poses a struggle for many organizations is what to do with their department file shares.
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses

972 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question