Skip to content

Commit c5559f5

Browse files
Maddy-CloudflareMaddy-Cloudflare
committed
Adding Cisco prereqs, partials, and renaming URLs
1 parent f796b60 commit c5559f5

File tree

7 files changed

+245
-7
lines changed

7 files changed

+245
-7
lines changed

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/cisco-email-security-mx.mdx‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
title: Cisco - Email Security as MX Record
3+
pcx_content_type: integration-guide
4+
sidebar:
5+
order: 5
6+
---
7+
8+
import { Render } from "~/components"
9+
10+
11+
In this tutorial, you will learn how to configure Cisco IronPort with Email Security as MX record.
12+
13+
<Render file="deployment/mx-deployment-prerequisites" product="email-security"/>
14+
15+
## 1. Add a Sender Group for Email Security Email Protection IPs
16+
17+
To add a new Sender Group:
18+
19+
1. Go to **Mail Policies** > **HAT Overview**.
20+
21+
2. Select **Add Sender Group**.
22+
23+
3. Configure the new Sender Group as follows:
24+
- **Name**: `Email Security`.
25+
- **Order**: Order above the existing **WHITELIST** sender group.
26+
- **Comment**: `Email Security Email Protection egress IP Addresses`.
27+
- **Policy**: `TRUSTED` (by default, spam detection is disabled for this mail flow policy).
28+
- **SBRS**: Leave blank.
29+
- **DNS Lists**: Leave blank.
30+
- **Connecting Host DNS Verification**: Leave all options unchecked.
31+
32+
4. Select **Submit and Add Senders** and add the IP addresses mentioned in [Egress IPs](/cloudflare-one/email-security/setup/pre-delivery-deployment/egress-ips/).
33+
34+
## 2. Configure Incoming Relays
35+
36+
You need to configure the Incoming Relays section to tell IronPort to ignore upstream hops, since all the connections are now coming from Email Security. This step is needed so the IronPort can retrieve the original IPs to calculate IP reputation. IronPort also uses this information in the Anti-Spam (IPAS) scoring of messages.
37+
38+
1. To enable the Incoming Relays Feature, select **Network** > **Incoming Relays**.
39+
2. Select **Enable** and commit your changes.
40+
3. Now, you will have to add an Incoming Relay. Select **Network** > **Incoming Relays**.
41+
4. Select **Add Relay** and give your relay a name.
42+
5. Enter the IP address of the MTA, MX, or other machine that connects to the email gateway to relay incoming messages. You can use IPv4 or IPv6 addresses.
43+
6. Specify the `Received:` header that will identify the IP address of the original external sender.
44+
7. Commit your changes.
45+
46+
## 3. Disable SPF checks
47+
48+
Make sure you disable Sender Policy Framework (SPF) checks in IronPort. Because Email Security is acting as the MX record, if you do not disable SPF checks, IronPort will block emails due to an SPF failure.
49+
50+
Refer to [Cisco's documentation](https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117973-faq-esa-00.html) for more information on how to disable SPF checks.
51+
52+
## Next steps
53+
54+
Now that you have completed the prerequisite steps, you can set up [MX/Inline](/cloudflare-one/email-security/setup/pre-delivery-deployment/inline-deployment-setup/) on the Cloudflare dashboard.

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/cisco-mx.mdx‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
---
2+
title: Cisco - Cisco as MX Record
3+
pcx_content_type: integration-guide
4+
sidebar:
5+
order: 6
6+
---
7+
8+
import { GlossaryTooltip, Render } from "~/components"
9+
10+
11+
In this tutorial, you will learn how to configure Email Security with Cisco as MX record.
12+
13+
## 1. Add a Sender Group for Email Security Email Protection IPs
14+
15+
To add a new Sender Group:
16+
17+
1. Go to **Mail Policies** > **HAT Overview**.
18+
19+
2. Select the **Add Sender Group** button.
20+
21+
3. Configure the new Sender Group as follows:
22+
- **Name**: `Email Security`.
23+
- **Order**: Order above the existing **WHITELIST** sender group.
24+
- **Comment**: `Email Security Email Protection egress IP Addresses`.
25+
- **Policy**: `TRUSTED` (by default, spam detection is disabled for this mail flow policy).
26+
- **SBRS**: Leave blank.
27+
- **DNS Lists**: Leave blank.
28+
- **Connecting Host DNS Verification**: Leave all options unchecked.
29+
30+
4. Select **Submit and Add Senders**, and add the IP addresses mentioned in [Egress IPs](/cloudflare-one/email-security/setup/pre-delivery-deployment/egress-ips/). If you need to process emails in the EU or India regions for compliance purposes, add those IP addresses as well.
31+
32+
## 2. Add <GlossaryTooltip term="SMTP">SMTP</GlossaryTooltip> route for the Email Security Email Protection Hosts
33+
34+
To add a new SMTP Route:
35+
36+
1. Go to **Network** > **SMTP Routes**.
37+
38+
2. Select **Add Route**.
39+
40+
3. Configure the new SMTP Route as follows:
41+
* **Receiving Domain**: `a1s.mailstream`
42+
* In **Destination Hosts**, select **Add Row**, and add the Email Security MX hosts. Refer to the [Geographic locations](#5-geographic-locations) table for more information on what MX hosts to use.
43+
44+
## 3. Create Incoming Content Filters
45+
46+
To manage the mail flow between Email Security and Cisco ESA, you need two filters:
47+
48+
* One to direct all incoming messages to Email Security.
49+
* One to recognize messages coming back from Email Security to route for normal delivery.
50+
51+
### Incoming Content Filter - To Email Security
52+
53+
To create a new Content Filter:
54+
55+
1. Go to **Mail Policies** > **Incoming Content Filters**.
56+
57+
2. Select **Add Filter** to create a new filter.
58+
59+
3. Configure the new Incoming Content Filter as follows:
60+
- **Name**: `ESA_to_A1S`
61+
- **Description**: `Redirect messages to Email Security for anti-phishing inspection`
62+
- **Order**: This will depend on your other filters.
63+
- **Condition**: No conditions.
64+
- **Actions**:
65+
- For **Action** select **Send to Alternate Destination Host**.
66+
- For **Mail Host** input `a1s.mailstream` (the SMTP route configured in step 2).
67+
68+
### Incoming Content Filter - From Email Security
69+
70+
To create a new Content Filter:
71+
72+
1. Go to **Mail Policies** > **Incoming Content Filters**.
73+
74+
2. Select the **Add Filter** button to create a new filter.
75+
76+
3. Configure the new Incoming Content Filter as follows:
77+
- **Name**: `A1S_to_ESA`
78+
- **Description**: `Email Security inspected messages for final delivery`
79+
- **Order**: This filter must come before the previously created filter.
80+
- **Conditions**: Add conditions of type **Remote IP/Hostname** with all the IP addresses mentioned in [Egress IPs](/cloudflare-one/email-security/setup/pre-delivery-deployment/egress-ips/). For example:
81+
Order | Condition | Rule
82+
\----- | -------------------- | ---
83+
`1` | `Remote IP/Hostname` | `52.11.209.211`
84+
`2` | `Remote IP/Hostname` | `52.89.255.11`
85+
`3` | `Remote IP/Hostname` | `52.0.67.109`
86+
`4` | `Remote IP/Hostname` | `54.173.50.115`
87+
`5` | `Remote IP/Hostname` | `104.30.32.0/19`
88+
`6` | `Remote IP/Hostname` | `158.51.64.0/26`
89+
`7` | `Remote IP/Hostname` | `158.51.65.0/26`
90+
* Ensure that the *Apply rule:* dropdown is set to **If one or more conditions match**.
91+
* **Actions**: Select **Add Action**, and add the following:
92+
Order | Action | Rule
93+
\--- | -------------------- | ---
94+
1 | `Skip Remaining Content Filters (Final Action)` | `skip-filters()`
95+
96+
## 4. Add the Incoming Content Filter to the Inbound Policy table
97+
98+
Assign the Incoming Content Filters created in [step 3](#3-create-incoming-content-filters) to your primary mail policy in the Incoming Mail Policy table. Then, commit your changes to activate the email redirection.
99+
100+
## 5. Geographic locations
101+
102+
<Render file="deployment/mx-geographic-locations" product="email-security"/>
103+
104+
## Next steps
105+
106+
Now that you have completed the prerequisite steps, you can set up [MX/Inline](/cloudflare-one/email-security/setup/pre-delivery-deployment/inline-deployment-setup/) on the Cloudflare dashboard.

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/google-prerequisites.mdx‎ renamed to ‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/gsuite-email-security-mx.mdx‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Google Workspace as MX Record
3-
pcx_content_type: concept
3+
pcx_content_type: integration-guide
44
sidebar:
55
order: 4
66
---
@@ -13,14 +13,14 @@ In this tutorial, you will learn how to configure Google Workspace with Email Se
1313
- Access to the Google administrator console ([Google administrator console](https://admin.google.com/) > **Apps** > **Google Workspace** > **Gmail**).
1414
- Access to the domain nameserver hosting the MX records for the domains that will be processed by Email Security.
1515

16-
## Set up Inbound Email Configuration
16+
## 1. Set up Inbound Email Configuration
1717

1818
On the [Google administrative console](https://admin.google.com/), set up [Inbound Email Configuration](https://support.google.com/a/answer/60730?hl=en) with the following details:
1919
- In **Gateway IPs**, select the **Add** link, and add the IPs mentioned in [Egress IPs](/cloudflare-one/email-security/setup/pre-delivery-deployment/egress-ips/).
2020
- Select **Automatically detect external IP (recommended)**.
2121
- Select **Require TLS for connections from the email gateways listed above**.
2222

23-
## Set up an email quarantine
23+
## 2. Set up an email quarantine
2424

2525
[Set up an email quarantine](https://support.google.com/a/answer/6104172?hl=en#:~:text=Sign%20in%20with%20an%20administrator,t%20access%20the%20Admin%20console.&text=Manage%20quarantines.,Click%20Add%20Quarantine.):
2626
- In the quarantine configuration pop-up, enter the following details:
@@ -29,7 +29,7 @@ On the [Google administrative console](https://admin.google.com/), set up [Inbou
2929
3. For the **Inbound denial consequence**, select **Drop message**.
3030
4. For the **Outbound denial consequence**, select **Drop message**.
3131

32-
## Create a content compliance filter
32+
## 3. Create a content compliance filter
3333

3434
Create a [content compliance filter](https://support.google.com/a/answer/1346934?hl=en#zippy=%2Cstep-go-to-gmail-compliance-settings-in-the-google-admin-console%2Cstep-enter-email-messages-to-affect) to send malicious messages to quarantine:
3535
- **Name**: `Quarantine Email Security Malicious`.
@@ -53,4 +53,6 @@ If you would like to quarantine the other dispositions, repeat the above steps a
5353

5454
If desired, you can create a separate quarantine for each of the dispositions.
5555

56+
## Next steps
57+
5658
Now that you have completed the prerequisite steps, you can set up [MX/Inline](/cloudflare-one/email-security/setup/pre-delivery-deployment/inline-deployment-setup/) on the Cloudflare dashboard.

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/office365-prerequisites.mdx‎ renamed to ‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/office365-email-security-mx.mdx‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
---
22
title: Office 365 as MX Record
3-
pcx_content_type: concept
3+
pcx_content_type: integration-guide
44
sidebar:
55
order: 3
66
---
77

88
In this tutorial, you will learn how to configure Microsoft Office 365 with Email Security as its MX record.
99

10-
## Add Email Security IP addresses to Allow List
10+
## 1. Add Email Security IP addresses to Allow List
1111

1212
1. Go to the [Anti-spam policies page](https://security.microsoft.com/antispam) > Select **Edit connection filter policy**.
1313
2. In **Always allow messages from the following IP addresses or address range**, add IP addresses and CIDR blocks mentioned in Egress IPs.
@@ -18,7 +18,7 @@ In this tutorial, you will learn how to configure Microsoft Office 365 with Emai
1818
- Select **[Edit spam threshold and properties](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-bulk-complaint-level-bcl-about)** > **Mark as spam** > **SPF record: hard fail**, and ensure it is set to **Off**.
1919
5. Select **Save**.
2020

21-
## Enhanced Filtering configuration
21+
## 2. Enhanced Filtering configuration
2222

2323
### Create an inbound connector
2424

@@ -39,4 +39,6 @@ Now that the inbound connector has been configured, you will need to enable the
3939
2. Select **Automatically detect and skip the last IP address** and **Apply to entire organization**.
4040
3. Select **Save**.
4141

42+
## Next steps
43+
4244
Now that you have completed the prerequisite steps, you can set up [MX/Inline](/cloudflare-one/email-security/setup/pre-delivery-deployment/inline-deployment-setup/) on the Cloudflare dashboard.

‎src/content/partials/cloudflare-one/email-security/deployment/mx-deployment-prerequisites.mdx‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
{}
3+
---
4+
5+
## Prerequisites
6+
7+
To ensure changes made in this tutorial take effect quickly, update the Time to Live (TTL) value of the existing MX records on your domains to five minutes. Do this on all the domains you will be deploying.
8+
9+
Changing the TTL value instructs DNS servers on how long to cache this value before requesting an update from the responsible nameserver. You need to change the TTL value before changing your MX records to Cloudflare Email Security (formerly Area 1). This will ensure that changes take effect quickly and can also be reverted quickly if needed. If your DNS manager does not allow for a TTL of five minutes, set it to the lowest possible setting.
10+
11+
To check your existing TTL, open a terminal window and run the following command against your domain:
12+
13+
```sh
14+
dig mx <YOUR_DOMAIN>
15+
```
16+
17+
```sh output
18+
19+
; <<>> DiG 9.10.6 <<>> mx <YOUR_DOMAIN>
20+
;; global options: +cmd
21+
;; Got answer:
22+
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39938
23+
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1
24+
25+
;; OPT PSEUDOSECTION:
26+
; EDNS: version: 0, flags:; udp: 4096
27+
;; QUESTION SECTION:
28+
;domain. IN MX
29+
30+
;; ANSWER SECTION:
31+
<YOUR_DOMAIN>. 300 IN MX 5 mailstream-central.mxrecord.mx.
32+
<YOUR_DOMAIN>. 300 IN MX 10 mailstream-east.mxrecord.io.
33+
<YOUR_DOMAIN>. 300 IN MX 10 mailstream-west.mxrecord.io.
34+
```
35+
36+
In the above example, TTL is shown in seconds as `300` (or five minutes).
37+
38+
If you are using Cloudflare for DNS, you can leave the [TTL setting as **Auto**](/dns/manage-dns-records/reference/ttl/).
39+
40+
Below is a list with instructions on how to edit MX records for some popular services:
41+
42+
- **Cloudflare**: [Set up email records](/dns/manage-dns-records/how-to/email-records/)
43+
- **GoDaddy**: [Edit an MX Record](https://www.godaddy.com/help/edit-an-mx-record-19235)
44+
- **AWS**: [Creating records by using the Amazon Route 53 console](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-creating.html)
45+
- **Azure**: [Create DNS records in a custom domain for a web app](https://learn.microsoft.com/en-us/azure/dns/dns-web-sites-custom-domain)

‎src/content/partials/cloudflare-one/email-security/deployment/mx-deployment-values.mdx‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
{}
3+
4+
---
5+
6+
| MX Priority | Host |
7+
| ----------- | -------------------------------- |
8+
| `5` | `mailstream-eu1.mxrecord.io` |
9+
| `10` | `mailstream-central.mxrecord.mx` |
10+
| `20` | `mailstream-east.mxrecord.io` |
11+
| `20` | `mailstream-west.mxrecord.io` |

‎src/content/partials/cloudflare-one/email-security/deployment/mx-geographic-locations.mdx‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
{}
3+
4+
---
5+
6+
When configuring the Email Security (formerly Area 1) MX records, it is important to configure hosts with the correct MX priority. This will allow mail flows to the preferred hosts and fail over as needed.
7+
8+
Choose from the following Email Security MX hosts, and order them by priority. For example, if you are located outside the US and want to prioritize email processing in the EU, add `mailstream-eu1.mxrecord.io` as your first host, and then the US servers.
9+
10+
| Host | Location | Note |
11+
| -------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
12+
| <un><li>`mailstream-central.mxrecord.mx`</li> <li>`mailstream-east.mxrecord.io`</li> <li>`mailstream-west.mxrecord.io`</li></un> | US | Best option to ensure all email traffic processing happens in the US. |
13+
| `mailstream-eu1.mxrecord.io` | EU | Best option to ensure all email traffic processing happens in Germany, with backup to US data centers. |
14+
| `mailstream-bom.mxrecord.mx` | India | Best option to ensure all email traffic processing happens within India.
15+
| `mailstream-india-primary.mxrecord.mx` | India | Same as `mailstream-bom.mxrecord.mx`, with backup to US data centers. |
16+
| `mailstream-asia.mxrecord.mx` | India | Best option to ensure all email traffic processing happens in India, with Australia data centers as backup.
17+
| `mailstream-syd.area1.cloudflare.net` | Australia / New Zealand | Best option to ensure all email traffic processing happens within Australia. |
18+
| `mailstream-australia-primary.area1.cloudflare.net` | Australia / New Zealand | Best option to ensure all email traffic processing happens in Australia, with India and US data centers as backup. |

0 commit comments

Comments
 (0)