Skip to content

Commit 986f9c8

Browse files
Maddy-CloudflareOxyjun
Maddy-Cloudflare
and
Oxyjun
authored
[Email Security] Inline deployment docs (#19099)
* [Email Security] Inline deployment docs * Fixing link * Apply suggestions from code review Co-authored-by: Jun Lee <[email protected]> * Updating steps * Adding prereq steps and egress ips * Typo * Fixing link * Adding Cisco prereqs, partials, and renaming URLs * Fixing steps * Add submission addresses * Remove space * Adding graphs * Adding Cisco diagrams * Remove submission addresses * Apply suggestions from code review Co-authored-by: Jun Lee <[email protected]> * Correcting UI component * Update src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/inline-deployment-setup.mdx Co-authored-by: Jun Lee <[email protected]> * Correcting table * Making steps optional * Open Egress IPs to new page * Update copy * Add instructions about quarantining on MS365 * update links * Fixing broken link + updating note * Update src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/office365-email-security-mx.mdx Co-authored-by: Jun Lee <[email protected]> * Removing partial --------- Co-authored-by: Jun Lee <[email protected]>
1 parent cacde61 commit 986f9c8

File tree

17 files changed

+614
-0
lines changed

17 files changed

+614
-0
lines changed

‎src/assets/email-security/Cisco_to_Cisco_MX_Inline.png‎

24.2 KB
Loading

‎src/assets/email-security/Cisco_to_Email_Security_MX_Inline.png‎

23.7 KB
Loading

‎src/assets/email-security/Email_Security_Gmail_MX_Inline.png‎

18.9 KB
Loading

‎src/assets/email-security/Email_Security_O365_MXInline.png‎

11.2 KB
Loading

‎src/assets/images/email-security/deployment/inline-setup/CF_A1S_Deployment_Inline_Diagrams.png‎

16.7 KB
Loading

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/egress-ips.mdx‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
---
2+
title: Egress IPs
3+
pcx_content_type: reference
4+
sidebar:
5+
order: 4
6+
---
7+
8+
When you set up Email Security using an [MX/Inline deployment](/cloudflare-one/email-security/setup/pre-delivery-deployment/mx-inline-deployment/), you need to tell your existing email providers to accept messages coming from Email Security's egress IP addresses.
9+
10+
Refer to this page for reference on what IP subnet mask ranges to use.
11+
12+
:::caution[Additional information for O365]
13+
14+
Office 365 does not support IPv6 addresses nor the following IPv4 subnet mask ranges:
15+
16+
* `104.30.32.0/19`
17+
* `134.195.26.0/23`
18+
19+
If you use Office 365, you will have to use the broken down `/24` subnet mask IP addresses. Refer to [Office 365 `/24` addresses](#office-365-24-addresses) for a list of supported IPv4 addresses.
20+
21+
22+
:::
23+
24+
## United States
25+
26+
For customers in the United States, enter the following IP addresses:
27+
28+
### IPv4
29+
30+
```txt
31+
52.11.209.211
32+
52.89.255.11
33+
52.0.67.109
34+
54.173.50.115
35+
104.30.32.0/19
36+
158.51.64.0/26
37+
158.51.65.0/26
38+
134.195.26.0/23
39+
```
40+
41+
### IPv6
42+
43+
```txt
44+
2405:8100:c400::/38
45+
```
46+
47+
## Europe
48+
49+
For customers in Europe, add all our US IP addresses. Additionally, you need to add the following IP addresses for our European data centers:
50+
51+
```txt
52+
52.58.35.43
53+
35.157.195.63
54+
```
55+
56+
## India
57+
58+
For customers in India, add all our US IP addresses.
59+
60+
## Australia / New Zealand
61+
62+
For customers in Australia and New Zealand, add all our US IP addresses.
63+
64+
## Office 365 `/24` addresses
65+
66+
Use these IPv4 addresses for Office 365, instead of the `/19` and `/23` subnets:
67+
68+
```txt
69+
104.30.32.0/24
70+
104.30.33.0/24
71+
104.30.34.0/24
72+
104.30.35.0/24
73+
104.30.36.0/24
74+
104.30.37.0/24
75+
104.30.38.0/24
76+
104.30.39.0/24
77+
104.30.40.0/24
78+
104.30.41.0/24
79+
104.30.42.0/24
80+
104.30.43.0/24
81+
104.30.44.0/24
82+
104.30.45.0/24
83+
104.30.46.0/24
84+
104.30.47.0/24
85+
104.30.48.0/24
86+
104.30.49.0/24
87+
104.30.50.0/24
88+
104.30.51.0/24
89+
104.30.52.0/24
90+
104.30.53.0/24
91+
104.30.54.0/24
92+
104.30.55.0/24
93+
104.30.56.0/24
94+
104.30.57.0/24
95+
104.30.58.0/24
96+
104.30.59.0/24
97+
104.30.60.0/24
98+
104.30.61.0/24
99+
104.30.62.0/24
100+
104.30.63.0/24
101+
134.195.26.0/24
102+
134.195.27.0/24
103+
```

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/index.mdx‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
title: Pre-delivery deployment
3+
pcx_content_type: navigation
4+
sidebar:
5+
order: 1
6+
group:
7+
hideIndex: true
8+
---
9+
10+
import { DirectoryListing } from "~/components"
11+
12+
13+
14+
<DirectoryListing />

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/mx-inline-deployment-setup.mdx‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
---
2+
title: Set up MX/Inline deployment
3+
pcx_content_type: concept
4+
sidebar:
5+
order: 3
6+
---
7+
8+
To set up MX/Inline:
9+
10+
1. Log in to [Zero Trust](https://one.dash.cloudflare.com/).
11+
2. Select **Email Security**.
12+
3. Select **Monitoring**. If you are a first time user, select **Contact sales**. Otherwise, select **Set up**.
13+
4. Select **MX/Inline**.
14+
5. To start the MX/Inline configuration, you will need to have completed the prerequisite setup on your email provider's platform. Once you have completed this step, select **I confirm that I have completed all the necessary requirements**. Then, select **Start configuration**.
15+
16+
If you have verified zones on Cloudflare, continue with the following steps:
17+
18+
1. **Connect a domain**: Select your domain. Then, select **Continue**.
19+
2. **Select position**: This step allows you to choose where Email Security fits into your mail flow and configure position settings:
20+
- **Select position**: Choose between:
21+
- **Sit first (hop count = 1)**: Email Security is the first server that receives the email. There are no other email scanners or services between the Internet and Cloudflare.
22+
- **Sit in the middle (hop count > 1)**: Email Security sits anywhere other than the first position. Other servers receive emails _before_ Email Security. There are other email scanners or email services in between.
23+
- **Position settings**: Refine how Email Security receives and forwards emails:
24+
- **Forwarding address**: This is your mail flow next hop after Email Security. This value is auto-filled, but you can still change it.
25+
- **Outbound TLS**: Choose between:
26+
1. **Forward all messages over TLS** (recommended).
27+
2. **Forward all messages using opportunistic TLS**.
28+
- Select **Continue**.
29+
3. (**Optional**, select **Skip for now** to skip this step) **Configure quarantine policy**: Select dispositions to automatically prevent certain types of incoming messages from reaching a recipient's inbox.
30+
4. (Optional) **Update MX records**:
31+
- Email Security can automatically update MX records for domains that proxy traffic through Cloudflare. Under **Your mail processing location**, select your mail processing location.
32+
- You can also choose to allow Cloudflare to update MX records by selecting **I confirm that I allow Cloudflare to update to the new MX records**. When Email Security updates MX records, we replace your original MX records with Email Security MX records.
33+
- Select **Continue**.
34+
5. **Review details**: Review your domain, then select **Go to domains**.
35+
36+
## Users who do not have domains with Cloudflare
37+
38+
If you do not have domains with Cloudflare, the dashboard will display two options:
39+
40+
- Add a domain to Cloudflare.
41+
- Enter domain manually.
42+
43+
### Add a domain to Cloudflare
44+
45+
Selecting **Add a domain to Cloudflare** will redirect you to a new page where you will connect your domain to Cloudflare. Once you have entered an existing domain, select **Continue**.
46+
47+
Then, follow the steps to [Set up MX/Inline](/cloudflare-one/email-security/setup/pre-delivery-deployment/mx-inline-deployment-setup/).
48+
49+
### Enter domain manually
50+
51+
1. **Add domains**: Manually enter domain names.
52+
2. **Review all domains**: Review all your domains, then select **Continue**.
53+
3. **Verify your domains**: It may take up to 24 hours for your domains to be verified. Select **Done**.
54+
4. Once your domains have been verified, the dashboard will display a message like this: **You have verified domains ready to connect to Email Security**. This means that you can now set up Email Security via MX/Inline.
55+
5. Select **Set up**, then select **MX/Inline**.
56+
6. Follow the steps to [Set up MX/Inline](/cloudflare-one/email-security/setup/pre-delivery-deployment/mx-inline-deployment-setup/).

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/mx-inline-deployment.mdx‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
title: MX/Inline deployment
3+
pcx_content_type: concept
4+
sidebar:
5+
order: 2
6+
---
7+
8+
With pre-delivery deployment, also known as Inline deployment, Email Security evaluates email messages before they reach a user's inbox.
9+
10+
Email Security becomes a hop in the SMTP processing chain and physically interacts with incoming email messages. Based on your policies, various messages are blocked before reaching the inbox.
11+
12+
When you choose an inline deployment, you get the following benefits:
13+
14+
- Messages are processed and physically blocked before arriving in a user's mailbox.
15+
- Your deployment is simpler, because any complex processing can happen downstream and without modification.
16+
- Email Security can modify delivered messages, adding subject or body mark-ups.
17+
- Email Security can offer high availability and adaptive message pooling.
18+
- You can set up advanced handling downstream for non-quarantined messages with added X-headers.
19+
20+
![Inline deployment diagram](~/assets/images/email-security/deployment/inline-setup/CF_A1S_Deployment_Inline_Diagrams.png)

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/cisco-email-security-mx.mdx‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
title: Cisco - Email Security as MX Record
3+
pcx_content_type: integration-guide
4+
sidebar:
5+
order: 5
6+
---
7+
8+
import { Render } from "~/components"
9+
10+
![A schematic showing where Email Security sits in the life cycle of an email received](src/assets/email-security/Cisco_to_Email_Security_MX_Inline.png)
11+
12+
In this tutorial, you will learn how to configure Cisco IronPort with Email Security as MX record.
13+
14+
<Render file="deployment/mx-deployment-prerequisites" product="email-security"/>
15+
16+
## 1. Add a Sender Group for Email Security Email Protection IPs
17+
18+
To add a new Sender Group:
19+
20+
1. Go to **Mail Policies** > **HAT Overview**.
21+
22+
2. Select **Add Sender Group**.
23+
24+
3. Configure the new Sender Group as follows:
25+
- **Name**: `Email Security`.
26+
- **Order**: Order above the existing **WHITELIST** sender group.
27+
- **Comment**: `Email Security Email Protection egress IP Addresses`.
28+
- **Policy**: `TRUSTED` (by default, spam detection is disabled for this mail flow policy).
29+
- **SBRS**: Leave blank.
30+
- **DNS Lists**: Leave blank.
31+
- **Connecting Host DNS Verification**: Leave all options unchecked.
32+
33+
4. Select **Submit and Add Senders** and add the IP addresses mentioned in <a href="/cloudflare-one/email-security/setup/pre-delivery-deployment/egress-ips/" target="_blank">Egress IPs</a>
34+
35+
## 2. Configure Incoming Relays
36+
37+
You need to configure the Incoming Relays section to tell IronPort to ignore upstream hops, since all the connections are now coming from Email Security. This step is needed so the IronPort can retrieve the original IPs to calculate IP reputation. IronPort also uses this information in the Anti-Spam (IPAS) scoring of messages.
38+
39+
1. To enable the Incoming Relays Feature, select **Network** > **Incoming Relays**.
40+
2. Select **Enable** and commit your changes.
41+
3. Now, you will have to add an Incoming Relay. Select **Network** > **Incoming Relays**.
42+
4. Select **Add Relay** and give your relay a name.
43+
5. Enter the IP address of the MTA, MX, or other machine that connects to the email gateway to relay incoming messages. You can use IPv4 or IPv6 addresses.
44+
6. Specify the `Received:` header that will identify the IP address of the original external sender.
45+
7. Commit your changes.
46+
47+
## 3. Disable SPF checks
48+
49+
Make sure you disable Sender Policy Framework (SPF) checks in IronPort. Because Email Security is acting as the MX record, if you do not disable SPF checks, IronPort will block emails due to an SPF failure.
50+
51+
Refer to [Cisco's documentation](https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117973-faq-esa-00.html) for more information on how to disable SPF checks.
52+
53+
## Next steps
54+
55+
Now that you have completed the prerequisite steps, you can set up [MX/Inline](/cloudflare-one/email-security/setup/pre-delivery-deployment/mx-inline-deployment-setup/) on the Cloudflare dashboard.

0 commit comments

Comments
 (0)