User Guide. MailMarshal SMTP. Version 6.0

Transcription

1 User Guide MailMarshal SMTP Version 6.0

2 THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT ARE FURNISHED UNDER AND ARE SUBJECT TO THE TERMS OF A LICENSE AGREEMENT OR A NON-DISCLOSURE AGREEMENT. EXCEPT AS EXPRESSLY SET FORTH IN SUCH LICENSE AGREEMENT OR NON-DISCLOSURE AGREEMENT, MARSHAL LIMITED PROVIDES THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SOME STATES DO NOT ALLOW DISCLAIMERS OF EXPRESS OR IMPLIED WARRANTIES IN CERTAIN TRANSACTIONS; THEREFORE, THIS STATEMENT MAY NOT APPLY TO YOU. This document and the software described in this document may not be lent, sold, or given away without the prior written permission of Marshal Limited, except as otherwise permitted by law. Except as expressly set forth in such license agreement or non-disclosure agreement, no part of this document or the software described in this document may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, or otherwise, without the prior written consent of Marshal Limited. Some companies, names, and data in this document are used for illustration purposes and may not represent real companies, individuals, or data. This document could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein. These changes may be incorporated in new editions of this document. Marshal Limited may make improvements in or changes to the software described in this document at any time Marshal Limited, all rights reserved. U.S. Government Restricted Rights: If the software and documentation are being acquired by or on behalf of the U.S. Government or by a U.S. Government prime contractor or subcontractor (at any tier), in accordance with 48 C.F.R (for Department of Defense (DOD) acquisitions) and 48 C.F.R and (for non-dod acquisitions), the government s rights in the software and documentation, including its rights to use, modify, reproduce, release, perform, display or disclose the software or documentation, will be subject in all respects to the commercial license rights and restrictions provided in the license agreement. Check Point, FireWall-1, VPN-1, Provider-1, and SiteManager-1 are trademarks or registered trademarks of Check Point Software Technologies Ltd. Firewall Suite, MailMarshal, Security Reporting Center, and WebMarshal are trademarks or registered trademarks of Marshal Limited. All other company and product names mentioned are used only for identification purposes and may be trademarks or registered trademarks of their respective companies.

3 Contents Contents iii Chapter 1 Introduction 1 What Is MailMarshal?... 2 What Does MailMarshal Provide?... 2 How MailMarshal Helps You... 4 How Customers Use MailMarshal... 4 Legal Firm Gains Immunity From Network Issues... 5 Electronic Fulfillment House Optimizes Usage... 6 MailMarshal Customers Save Time and Money... 6 How MailMarshal Works... 7 Servers... 8 Configuration... 9 Monitoring and Reporting... 9 MailMarshal SMTP and MailMarshal for Exchange iii

4 Chapter 2 Planning Your MailMarshal Implementation 11 Deployment Checklist Understanding Deployment Scenarios MailMarshal as an Internal Relay MailMarshal as the Only Server MailMarshal and Other Software on the Same Server MailMarshal in a Distributed Array of Servers Hardware and Software Requirements Hardware Required for MailMarshal Server Software Required for MailMarshal Server Software Required for Other Components Network Access Required for MailMarshal Understanding Routing Background Information How MailMarshal Routes Setting up Outbound Routing Setting up Inbound Routing When Installing MailMarshal on the Existing Server Locating MailMarshal Folders Gathering Information Before Installation Chapter 3 Installing MailMarshal 29 Installation Checklist Installing Pre-Requisites Installing MailMarshal on a Single Server Installing MailMarshal on an Array of Servers Installing the Array Manager Server Installing an Processing Server iv User Guide

5 Post-Installation Configuration Steps Completing the Configuration Wizard Excluding Working Folders From Virus Scanning Configuring Routing Creating Directory Connectors Installing MailMarshal Reports Installing MailMarshal Web Components Installing MailMarshal Client Tools Upgrading MailMarshal Uninstalling MailMarshal Chapter 4 Understanding MailMarshal Interfaces 57 Understanding the Configurator Working With the Getting Started and Common Tasks Pages Working With Menu and Detail Items Working With Properties Configuration Committing Configuration Understanding the Console Understanding the Web Console Understanding the Reports Console Understanding the Spam Quarantine Management Web Site Understanding Other Tools Chapter 5 Implementing Your Content Security Policy 67 Configuring Content Security Stopping Spam Anti-Spam Configuration and Rules Configuring SpamCensor Updates v

6 Stopping Viruses...72 Anti-Virus Policy and Rules Installing and Configuring Virus Scanners Preventing Relaying Controlling Who Can Send Through Your Server DNS Blacklists PTR Lookups Blocked Hosts Authentication by Account Filtering Messages and Attachments Chapter 6 Understanding Policy, Policy Groups, and Rules 83 Understanding Policy Groups Understanding Rules Receiver Rules Standard Rules Creating Rules Understanding User Matching Understanding Rule Conditions Rule Conditions for Standard Rules Rule Conditions for Receiver Rules Understanding Rule Actions Rule Actions for Standard Rules Rule Actions for Receiver Rules Understanding Order of Evaluation Adjusting the Order of Evaluation of Policy Groups Adjusting the Order of Evaluation of Rules Viewing Policy vi User Guide

7

8 Header Matching and Rewriting Changing and Adding Headers with the Receiver Using Rules to Find Headers Using Rules to Change Headers Using the Header Rewrite Wizard Extending Functionality Using External Commands Chapter 8 Monitoring Flow 171 Using the MailMarshal Console Connecting to MailMarshal Using the Console Connecting to MailMarshal Using the Web Console Viewing Server Statistics Deleting and Retrying Queued Messages Using Mail Batching Viewing Folders and Folder Contents Working With Messages Viewing History Searching Folders and History Viewing Alert History Setting Console Security Using Windows Tools Event Log Performance Monitor Using MailMarshal Text Logs Chapter 9 Managing MailMarshal Configuration 191 Managing Your MailMarshal License Reviewing the Installed License Requesting a New License Key Entering a License Key viii User Guide

9 Backing Up and Restoring the Configuration Backing Up the Configuration Restoring the Configuration Configuring Local Domains Changing Local Domains Information Changing Local Domains on a Specific Server Setting Up Accounts Creating Accounts Editing Existing Accounts Deleting Accounts Configuring Delivery Options Configuring Default Delivery Options Configuring Delivery Options For A Specific Server Configuring Batching and Dial-Up Configuring Manager Security Managing Array Nodes Managing Node Services Adding and Deleting Nodes Joining A Node To An Array Customizing Settings for Nodes Setting Advanced Options Server Properties - Advanced Node Properties - Advanced Array Communications Folder Locations Quarantine Synchronization Tool Quarantine Upgrade Tool Group File Import Tool Configuration Export Tool ix

10 Chapter 10 Reporting on MailMarshal Activity 223 Data Retention and Grouping Data Retention Reporting Groups Connecting to the Database Generating Reports Available Reports Entering Parameters Available Parameters Navigating the Report Window Exporting Reports Chapter 11 Delegating Spam and Quarantine Management 237 Setting Up Console Access Setting Up Spam Quarantine Management Features Spam Quarantine Management Windows Setting Up Folders and Templates Setting Up Rules Setting Up Spam Quarantine Management for Other Folders Using the Message Release External Command Appendix A Wildcards and Regular Expressions 247 Wildcard Characters Regular Expressions Shortcuts Reserved Characters Examples Map Files x User Guide

11 Glossary 255 Index 261 xi

12 xii User Guide

13 About This Book and the Library The User Guide provides conceptual information about the MailMarshal SMTP product (MailMarshal SMTP). This book defines terminology and various related concepts. Intended Audience This book provides information for individuals responsible for understanding MailMarshal SMTP concepts and for individuals managing MailMarshal SMTP installations. Other Information in the Library The library provides the following information resources: Evaluation Guide Provides general information about the product and guides you through the trial and evaluation process. User Guide Provides conceptual information and detailed planning and installation information about MailMarshal SMTP. This book also provides an overview of the MailMarshal SMTP user interfaces and the Help. Help Provides context-sensitive information and step-by-step guidance for common tasks, as well as definitions for each field on each window. About This Book and the Library xiii

14 Conventions The library uses consistent conventions to help you identify items throughout the documentation. The following table summarizes these conventions. Convention Use Bold Window and menu items Technical terms, when introduced Italics Book and CD-ROM titles Variable names and values Emphasized words Fixed Font File and folder names Commands and code examples Text you must type Text (output) displayed in the command-line interface Brackets, such as [value] Optional parameters of a command Braces, such as {value} Required parameters of a command Logical OR, such as value1 value2 Exclusive parameters. Choose one parameter. xiv User Guide

15 About Marshal Marshal's Content Security products (MailMarshal for SMTP, MailMarshal for Exchange, WebMarshal, Security Reporting Center and Firewall Suite) deliver a complete and Web security solution to a variety of Internet risks. They provide comprehensive protection by acting as a gateway between an organization and the Internet. It allows organizations to restrict, block, copy, archive, and automatically manage the sending and receiving of messages. Marshal Products Marshal's Content Security solution, which includes MailMarshal SMTP, MailMarshal for Exchange and WebMarshal, delivers a complete and Web security solution to these risks by acting as a gateway between your organization and the Internet. The products sit behind your firewall but in front of your network systems to control outbound documents and their content. By providing anti-virus, anti-phishing and anti-spyware protection at the gateway, Marshal's Content Security solution offers you a strategic, flexible and scalable platform for policy-based filtering that protects your network, and as a result, your reputation. Contacting Marshal Please contact us with your questions and comments. We look forward to hearing from you. For support around the world, please contact your local partner. For a complete list of our partners, please see our Web site. If you cannot contact your partner, please contact our Technical Support team. Telephone: Sales Support: Web Site: +44 (0) (EMEA) (Americas) (Asia-Pacific) info@marshal.com About Marshal xv

16 xvi User Guide

17 Chapter 1 Introduction is an essential communication tool used by nearly every business and organization. is widely used because it provides an open, effective, rapid, and inexpensive way of sending text, images, and other data nearly anywhere. However, the same features that make such a useful tool also present issues and hidden costs. Spam, viruses, malicious code, legal liability issues, and declining employee productivity are all risks associated with the use of by organizations. Spam commonly accounts for more than half of the that an organization receives. viruses, Trojans and other malicious files spread around the world and can cause millions of dollars in damage in just a matter of hours. Every day brings new reports of organizations forced into legal action due to staff misuse of . remains the lifeblood of modern business communication, but the disadvantages of use are growing rapidly. MailMarshal is an security solution specifically designed to deal with these issues. Many organizations today have created policies and guidelines for the appropriate use of , and employee education programs to deal with the torrent of spam and viruses. MailMarshal allows an organization to actually apply those policies and security rules to at their corporate gateway, defending the company against the risks and disadvantages of use. MailMarshal enables organizations to once again use safely, securely and productively. Chapter 1 Introduction 1

18 What Is MailMarshal? NetIQ MailMarshal SMTP is a fast, easy-to-use filtering solution that ensures a safe and productive working environment by enforcing organizational Acceptable Use Policy (AUP) and protecting against Spam and viruses. The product boasts a 95% Spam detection rate with less than 0.01% false positives, all while performing up to 4 times faster than the competition. Suspect messages are deleted, quarantined or simply monitored based on the needs of the organization. Administrators can generate meaningful reports depicting usage and security concerns while the company receives a significant return on investment (ROI) as workplace productivity increases, corporate assets are protected and the potential for corporate liability is diminished. Supporting enterprises with tens of thousands of users, MailMarshal SMTP is by far the most powerful, feature-rich Anti-Spam solution available today. What Does MailMarshal Provide? MailMarshal includes many powerful features to scan and filter messages. MailMarshal also gives the administrator granular control of policies, and the ability to delegate monitoring and control to other users. MailMarshal scans the content of messages and attachments as they enter or leave an organization. MailMarshal can: Block Spam using the NetIQ SpamCensor technology. This technology typically delivers a 95% Spam detection rate with less than 0.01% false positives. Scan for viruses using third-party virus scanners. Scan message text, headers, and attached documents for the presence of particular phrases. Recognize the type and size of attached items. Perform many other checks of message content. 2 User Guide

19 MailMarshal can take a wide variety of actions on messages that violate an Acceptable Use Policy. MailMarshal can: Refuse receipt of a message from a remote server. Quarantine a message for later review by administrators or users. Delete a message. Redirect a message. Log receipt of a message for future reference. In addition to a superior Spam detection rate and a full set of filtering abilities, MailMarshal provides high performance. MailMarshal yields single server processing throughput up to 4 times greater than competing products provide. You can install MailMarshal on multiple servers with centralized administration to support the enterprise. You can control MailMarshal installations at geographically separate locations from a single administrative server. MailMarshal also provides effective, easy-to-use interfaces. The administrator can monitor and control filtering activity using Windows and Web consoles. users can verify and customize Spam blocking for their own addresses using the Spam Quarantine Management Web site. The administrator and managers can generate a selection of reports detailing usage and filtering activity. Chapter 1 Introduction 3

20 How MailMarshal Helps You Unmonitored presents both financial and legal dangers to a company. For instance, Spam represents a dramatic financial threat in terms of the cost of storage, bandwidth, and wasted employee time. Virus infection and malicious code can be costly in employee time and in lost data. Inappropriate and offensive content is both a time waster and a potential legal liability. With MailMarshal, a company receives a significant return on investment (ROI) as network security is tightened, corporate assets are protected, the potential for corporate liability is diminished, and workplace productivity increases. How Customers Use MailMarshal You can configure MailMarshal to support your Acceptable Use Policy for usage. Enforcing the Acceptable Use Policy often results in savings of network resources and time. You can also use MailMarshal to provide a variety of gateway based services that enhance functionality and convenience. The following stories show how some of our customers put MailMarshal to work. 4 User Guide

21 Legal Firm Gains Immunity From Network Issues Law firms rely on their Internet and -based communications to stay in contact with clients and staff, both locally and in distant locations. With the increasing number of Internet-based threats making the rounds, it is essential that these risks are kept to an absolute minimum. The IT manager of a law firm that installed MailMarshal five years ago has this to say about the experience: Ever since we installed MailMarshal, we've been totally immune to shutdowns due to -based viruses, worms, Trojan horses and other malignant payloads. We hear about them from colleagues and read about them in newspapers, but we don't see them at work. Nobody, of course, would knowingly introduce a dangerous file into the system, but the danger is in an inadvertent download or access. We have very strict controls as to what attachments are allowed through to prevent accidental infection. For instance, we quarantine all executable files as well as others that might be dangerous. Questionable s or attachments that come in are quarantined for manual over-ride during work hours or saved until the morning if they come in at night. This way we can monitor usage without being too invasive. At the end of the day, the main benefit is that we ve avoided any problems, shutdowns or slowdowns with our and Internet and that, more than anything, is invaluable. Result: Reduced network congestion, reduced IT running costs, long term system stability and added security. Chapter 1 Introduction 5

22 Electronic Fulfillment House Optimizes Usage With over 2 million members ordering their books online, a leading book club needed to optimize their system to provide comprehensive support for marketing, order taking, fulfillment and transaction management. The senior systems analyst for the company comments: has gone from a 'best endeavors' service to a mission critical resource. We needed a flexible and mature system that could handle any situation as well as be scalable and easy to install and maintain. We did a full evaluation of the major available management packages, and MailMarshal was the product that best addressed our needs. The installation process was extremely painless. We simply swapped our old anti-virus gateway for MailMarshal and haven't looked back since. In fact, we have seen an increase in our usage because our network capacity has been optimized. Result: Increased staff productivity via unobtrusive monitoring and reduction of excessive usage. MailMarshal effectively separates corporate and customer traffic. MailMarshal Customers Save Time and Money MailMarshal delivers benefits every day to large and small organizations. What follows is just a small sample of stories from the files: A 300-user city council was infected twice by the Navidad virus. This event resulted in 300 desktop computers being down for one and a half hours. All software had to be reinstalled and any unsaved documents were lost. The infection cost the council over $24,000 in lost staff productivity alone. The council then installed MailMarshal on a 30-day trial. MailMarshal prevented a further 150 Navidad virus infections over the following week. A large commercial airline implemented MailMarshal and reduced their bandwidth usage by 50% immediately, simply by stopping video files. 6 User Guide

23 A finance company reduced their bandwidth usage by 87% when they implemented an policy with MailMarshal that denied all files other than Microsoft Office documents. A respected IT company was invited to evaluate MailMarshal's anti-spam effectiveness for one month against a competitor of their choice. They ran the test in a live head-to-head trial with a major MailMarshal competitor. The products evaluated duplicate inbound streams. At the end of the test the IT company reported back: - MailMarshal detected over 92% of the spam the company received with only one false positive over the entire month. - The competitor managed to detect just 81% of the spam but also created 189 false positives (more than 6 per day). The company has since purchased MailMarshal. A large multi-national finance company performed an extended threemonth trial of MailMarshal. After monitoring activity for the first two months and then implementing an Acceptable Use Policy with MailMarshal in the final month, the customer reported that they reduced non-business by 98%. How MailMarshal Works MailMarshal is a server-based Simple Mail Transfer Protocol (SMTP) content scanner that can be easily installed into a new or existing network with other gateway applications. It complements, and is compatible with, traditional Internet firewalls, SMTP mail servers, anti-virus scanners, and other security applications. A MailMarshal installation consists of several pieces of software, including a manager server, one or more processing servers, a SQL database, and optional management Web sites. In a small organization these items can all be installed on a single server. In a large organization they can be installed as an array distributed on multiple servers. Chapter 1 Introduction 7

24 Servers MailMarshal user interfaces include a configuration console, administration console, reports console, Spam quarantine management Web site for users, and Web administration console. The MailMarshal processing server functions as the gateway of an organization. All entering or exiting the organization passes through it. MailMarshal can be configured with more than one processing server. MailMarshal can use multiple servers to provide multiple gateways, or to add bandwidth and redundancy to a single gateway. Each MailMarshal processing server includes four major system services: the Receiver, the Engine, the Sender, and the Controller. All enters the MailMarshal server via the Receiver, and is processed in the Engine. The Engine unpacks each message (expanding any archive or compressed files) and splits the message into its individual components. It then tests the whole message and each component using the policy. As part of the policy, MailMarshal filters Spam using the NetIQ SpamCensor technology. MailMarshal detects viruses by invoking other vendors virus checking software. Many commercially available scanners are supported by MailMarshal. The results of rule processing determine whether each message is accepted, modified or quarantined. Accepted is passed to the MailMarshal Sender, which then forwards it to the appropriate recipients. The MailMarshal Array Manager functions as a central repository for configuration. It coordinates the activity of the other MailMarshal components and serves as a connector between the processing servers, the user interfaces, and the database. The MailMarshal database resides on a Microsoft SQL Server. It stores configuration information and logging data. 8 User Guide

25 Configuration The administrator configures MailMarshal from a workstation connected to the Manager server, using the MailMarshal Configurator. The initial configuration settings allow MailMarshal to act as the gateway of an organization. A wide variety of additional configuration options allow MailMarshal to enforce your Acceptable Usage Policy by controlling how MailMarshal processes SMTP connections and individual messages. Monitoring and Reporting MailMarshal provides several tools for monitoring and daily administration of . The main tool is the Console. The Console features MailMarshal Today, which provides a summary of MailMarshal activity and server health at a glance. Using the Console, an administrator can review the processing history for any message, and can view and release any quarantined message. The administrator can grant other users access to specific Console functions and specific quarantine folders. This allows the administrator to delegate basic tasks to help desk or departmental personnel. MailMarshal also provides a Web version of the Console, which permits remote access to the Console functionality. users can review and manage suspected Spam and other quarantined using daily digests and the Spam Quarantine Management console. This console is a Web application typically deployed on an intranet Web server. Administrators and managers can generate reports on MailMarshal activity using the MailMarshal Reports application. MailMarshal Reports uses the Crystal Reports engine to produce detailed reports. Chapter 1 Introduction 9

26 MailMarshal SMTP and MailMarshal for Exchange MailMarshal SMTP shares many features with MailMarshal for Exchange, the Exchange Server based Content Security product from NetIQ Corporation. An organization may choose to install one or both products. Each product delivers some unique benefits. MailMarshal for Exchange provides the ability to scan internal within the Exchange Server. MailMarshal SMTP provides several components which are not available within MailMarshal for Exchange, including the Spam Quarantine Management console, receiver rules and other SMTP receiver based functions. An organization that requires both sets of functions can run both products in the same environment. MailMarshal for Exchange and MailMarshal SMTP can be run on the same server, subject to adequate system resources. Within this Guide, MailMarshal always refers to MailMarshal SMTP unless otherwise stated. 10 User Guide

27 Chapter 2 Planning Your MailMarshal Implementation MailMarshal consists of several components, which can be located on different servers within an organization's network. The components are: One or more processing servers A SQL database The Configurator, used to define policy The Console, used to manage flow The Reports console Two Web components: the Spam Quarantine Management Web site and the Web Console The Array Manager, which connects the user interfaces, processing servers, and database These components can be installed in a variety of configurations to suit any size of organization from small business to distributed enterprise. Chapter 2 Planning Your MailMarshal Implementation 11

28 Deployment Checklist Choose your MailMarshal deployment options by completing the following checklist: Steps 1. Decide whether you will install MailMarshal as an Array or Standalone Server. 2. Decide the number and location of MailMarshal processing servers. 3. Decide the location of the SQL database. 4. Decide where MailMarshal folders will be located on each processing server 5. Check hardware and software prerequisites. 6. Check network access prerequisites. 7. Gather information about your environment. See Section Understanding Deployment Scenarios on page 12. Understanding Deployment Scenarios on page 12. Understanding Deployment Scenarios on page 12. Locating MailMarshal Folders on page 24. Hardware and Software Requirements on page 17. Network Access Required for MailMarshal on page 20. Gathering Information Before Installation on page Plan routing changes Understanding Routing on page 21. Understanding Deployment Scenarios This section discusses some typical options for the deployment of the MailMarshal components. Each option provides all required functions of an gateway. Many other configurations are possible. 12 User Guide

29 MailMarshal as an Internal Relay You can install MailMarshal on its own physical server, as an relay within an organization, as shown below: SMTP Port 25 SMTP Port 25 Workstation Internet Firewall MailMarshal Server Server Workstation Workstation Admin In this case the MailMarshal installation is a standalone server including all management and processing components. This option is suitable for small to medium sized organizations with a single Internet gateway and server. All workstations within the organization send through the server. The server forwards all external messages to the MailMarshal server for processing and delivery. The DNS MX record (or the firewall's relay setting) is set so that the MailMarshal server receives all inbound to the organization. Install the MailMarshal database on an available SQL server in the local network. In smaller organizations, it will be possible to install SQL Server or MSDE on the MailMarshal server. Install the MailMarshal Spam Quarantine Management Web site on an intranet Web server. Install MailMarshal Reports and optionally management consoles on one or more workstations in the local network. Chapter 2 Planning Your MailMarshal Implementation 13

30 MailMarshal as the Only Server MailMarshal can function as a POP3/SMTP server providing all server functions for a small organization, as shown below: Internet connection SMTP Port 25 POP3 Port 110 Workstation Internet ISP MailMarshal Server Workstation Workstation Admin In this example, workstations within the organization send to the MailMarshal server on port 25 for processing. MailMarshal delivers for internal addresses to MailMarshal POP3 mailboxes for collection by clients. Retrieve and send to and from external addresses over a dial-up or other link to an ISP. In this case the MailMarshal installation is a standalone server including all management and processing components. In most organizations that choose this scenario, it will be possible to install SQL Server or MSDE on the MailMarshal server. Install the MailMarshal Spam Quarantine Management Web site on an intranet Web server. Install MailMarshal Reports and optionally management consoles on one or more workstations in the local network. 14 User Guide

31 MailMarshal and Other Software on the Same Server MailMarshal can run on the same physical server as the organization's server software, as shown below: Port 25 MailMarshal Workstation Internet Firewall Localhost Port 97 Other Software Localhost Port 25 Workstation Server Computer Workstation Admin In this case, all sent from outside the organization arrives at the server computer on the default SMTP port, port 25. MailMarshal forwards processed inbound to the other server software using the localhost IP address and port 97. The other server sends for outside delivery to MailMarshal using the localhost IP address and port 25. Install the MailMarshal database on an available SQL server in the local network. MailMarshal is installed as a standalone server including all management and processing components. Install the MailMarshal Spam Quarantine Management Web site on an intranet Web server. Install MailMarshal Reports on one or more workstations in the local network Note This installation option depends on the server having sufficient resources to support both MailMarshal and another server application. Chapter 2 Planning Your MailMarshal Implementation 15

32 MailMarshal in a Distributed Array of Servers You can install MailMarshal as an array of servers for an enterprise. You can install the required components in a variety of configurations. A typical configuration is shown below: DMZ Local Users Internet Port 25 Port 25 Local Server MailMarshal Servers ( processing) Port MailMarshal SQM and Console Web sites Admin Port MailMarshal Array Manager and SQL Server In this example, the MailMarshal installation includes a load balanced array of MailMarshal processing servers in a DMZ. A DMZ is a part of a local network that has controlled access both to the Internet and to the internal network of the organization. All sent from within the organization passes through the local server, which delivers outbound messages to the MailMarshal servers on port 25. MailMarshal delivers incoming to the local server. Install the MailMarshal Array Manager on a SQL server or a dedicated server within the LAN to perform configuration and connect to the MailMarshal database. Install the MailMarshal Spam Quarantine Management Web site and the MailMarshal Web console on an intranet Web server. Open TCP port (or a single port of your choice) in the firewall between the DMZ and the Array Manager, to allow MailMarshal configuration and logging traffic. 16 User Guide

33 A distributed enterprise with more than one gateway can install one or more MailMarshal processing servers at each gateway. If the enterprise uses the same policies at all locations, it can use a single MailMarshal Array Manager to control configuration and perform logging for all locations. All the processing servers must be able to communicate with the Array Manager on port Install MailMarshal Reports and optionally management consoles on one or more workstations in the local network. Hardware and Software Requirements A basic stand-alone installation of MailMarshal will run on almost any Pentium III class computer running Windows 2000, Windows XP, or Windows Server Hardware Required for MailMarshal Server The hardware required for a MailMarshal server naturally varies depending on the number of users and the amount of traffic. The following specifications are a suggested minimum for a single-server installation of MailMarshal: 1,000 users: Pentium III 600, 10GB HD, 256MB RAM 10,000 users: Dual Pentium III 1000, 60GB HD, 1024MB RAM Sites with more than 10,000 users can use a single server with a higher specification, or multiple processing servers. Please contact NetIQ Technical Support for a recommended configuration. Chapter 2 Planning Your MailMarshal Implementation 17

34 Software Required for MailMarshal Server All prerequisite software (with the exception of the Windows operating system and the full version of SQL Server) is available on the installation CD-ROM. You can install the prerequisites during the MailMarshal installation from CD-ROM. However, NetIQ recommends that you install the prerequisites before installing MailMarshal, so as to isolate any installation issues to the specific package. MailMarshal requires: Windows 2000, Windows XP Professional, or Windows Server SQL Server 2000 or MSDE 2000 to store configuration and logging data. MSDE is a free runtime version of SQL Server. Because MSDE is limited to a total database size of 2GB, it is suitable for MailMarshal sites with fewer than 500 users. MSDE is included on the MailMarshal CD-ROM and in the trial download package. Service Pack 3 for SQL Server 2000 or MSDE This service pack is included in the version of MSDE 2000 distributed with MailMarshal. 18 User Guide

35 MSDE 2000 requires Microsoft Data Access Components (MDAC) 2.7 SP1, or a later version of MDAC. The MSDE installation will install this software if necessary. This installation requires a system restart. If you use named instances of SQL Server, you must install MDAC 2.8, or a later version of MDAC, on the server where you install the MailMarshal Array Manager. This installation requires a system restart. Notes Due to Microsoft licensing restrictions, the MailMarshal processing and Array Manager components cannot be installed on Windows Server 2003, Web Edition. However, the MailMarshal Web components can be installed on Web Edition. When you install prerequisites you should be prepared to restart the system. MailMarshal working and quarantine folders must reside on a NTFS partition. Due to the limitation on database size in MSDE, SQL Server is recommended for sites with more than 500 users. MSDE is limited to 5 client connections. This limits the number of instances of MailMarshal Reports you can use concurrently. Software Required for Other Components MailMarshal Configurator, Console, and Reports can run under Windows 2000, Windows XP Professional, or Windows Server If you use named instances of SQL Server, MailMarshal Reports require Microsoft Data Access Components (MDAC) 2.8, or a later version of MDAC. Chapter 2 Planning Your MailMarshal Implementation 19

36 The MailMarshal Web components (Spam Quarantine Management and the MailMarshal Web Console) can run under Windows 2000, Windows XP Professional, or Windows Server 2003, including the Web edition. They require: Windows 2000 Service Pack 3 or higher. Internet Information Services (IIS) 5.0 or higher. ASP.NET 1.1. ASP.NET is part of the.net Framework 1.1, available on the MailMarshal CD-ROM. Notes NetIQ recommends a secure Web site (HTTPS) for these components to protect user data and authentication information. If you install ASP.NET on a Windows Domain Controller, or on Windows 2000 Service Pack 4, review the Microsoft Knowledge Base for issue and fix information specific to those environments such as Microsoft Knowledge Base Articles and The Web components support browsing from Internet Explorer 5.5 and above. Network Access Required for MailMarshal Typically MailMarshal uses the following network protocols and ports: SMTP (port 25) from MailMarshal processing servers to the Internet and to the internal servers and/or clients. DNS (port 53, both TCP and UDP) from MailMarshal processing servers for resolution of external server names. TCP port for communication between the processing servers, Array Manager, and Console. This connection can be changed to another port of your choice. HTTP and HTTPS from the Array Manager to the Internet for access to SpamCensor updates (ports 80 and 443). You can use a proxy server for Web access if your environment requires it. 20 User Guide

37 SQL server connection (port 1433 by default) between the Array Manager and the SQL database, and between the database and any Reports Console. Various NetBios ports for communication between the Array Manager and the Configurator. For security reasons this connection should be within a trusted LAN (not through a firewall). A remote desktop connection, such as Microsoft Terminal Services, for access through a firewall to the processing servers. You can also use a remote desktop connection to connect securely through a firewall to the Configurator. POP3 (port 110) if MailMarshal is functioning as a POP3 server. Understanding Routing MailMarshal must be able to monitor all traffic at the gateway of an organization. Typically this requires some changes to routing. Background Information Internet travels from server to server using SMTP (Simple Mail Transfer Protocol). MailMarshal functions as a SMTP relay. Logically, MailMarshal is situated at the boundary of the local network so that entering or leaving the organization travels through it. Physically, a MailMarshal server can be installed in several scenarios. It can run on a dedicated computer, or in some cases share a computer with other software. For some typical configurations see earlier sections of this chapter. Before installing MailMarshal it is necessary to determine which functions MailMarshal will serve and how it will handle incoming and outgoing . In general, SMTP servers can route in four ways: By delivering a message to a local user (a user on the same server). By sending for a specific domain (for example wellknown.com) to a fixed address entered by the administrator. Chapter 2 Planning Your MailMarshal Implementation 21

38 By sending all outbound to a specific server ( relay). By performing a Domain Name Service (DNS) lookup to determine the appropriate server for a domain, and attempting to contact that host directly. How MailMarshal Routes MailMarshal can use any of the four methods described in the preceding section. If MailMarshal has been configured as a POP3 server, the POP3 mailboxes are local to it. MailMarshal uses the term Local Domains to name the specific domains for which MailMarshal functions as the Internet gateway. The local domains should include all of the domains hosted by other servers within the organization that use MailMarshal as a gateway (such as Exchange or Groupwise servers). Messages for these domains will be delivered to fixed addresses. Where the recipient of a message is not in a local domain, MailMarshal can be configured to deliver the message either by using DNS or by relaying to a specific host for delivery. Setting up Outbound Routing When you plan outbound routing, take note of how your existing server sends to the Internet. In general you should configure MailMarshal to use the same process. For instance, your server may deliver to a firewall or ISP ( relay), or directly using DNS. Reconfigure your existing server to forward all outbound Internet to MailMarshal. 22 User Guide

39 Setting up Inbound Routing When you plan inbound routing, determine how inbound is currently delivered to your server. If the MailMarshal server retains the IP address and server name of the previous server, then you will not have to change inbound settings. This will generally be true if you install MailMarshal on the same physical server as the other server software. If the MailMarshal server will have a different IP address and server name to your previous server, in most cases you must change the route to ensure that inbound messages are sent to the MailMarshal server. Before sending messages to your organization, an server on the Internet performs a DNS lookup to see which server (IP address) accepts for your domain. The address returned may be that of your server, firewall, proxy server or a downstream relay (for example an ISP). If messages are sent directly to your organization's server (the DNS MX lookup returned the server's IP address), then you must change the DNS MX record to return the IP address of the new MailMarshal server. You may also need to modify firewall permissions, to permit SMTP delivery to MailMarshal. If the DNS lookup returns the address of the firewall, and the firewall employs address translation, you must change the translated address for incoming to the address of the MailMarshal server. If the firewall acts as an relay, you must change the address to which it forwards inbound to that of the MailMarshal server. If the DNS lookup returns the address of an upstream relay, you must change the forwarding address setting used by that relay so that it directs to MailMarshal. Chapter 2 Planning Your MailMarshal Implementation 23

40 When Installing MailMarshal on the Existing Server When MailMarshal is installed on the same physical server as the existing server software, normally you will not need to change the inbound routing. However, because MailMarshal will take over the role of listening for SMTP traffic on port 25, you must configure the existing server to listen for SMTP traffic on another port. Port 97 is usually available and is commonly used for this purpose, but any free TCP port can be used. Configure MailMarshal, via its Local Domains information, to forward all inbound messages to the local computer on the new port. Use the localhost IP address Configure the existing server to forward all outbound messages to the local computer ( ) on port 25. Locating MailMarshal Folders A MailMarshal processing server uses folders for several purposes. By default, the installation process creates these folders within the MailMarshal program installation folder. In many cases this location is satisfactory. In some cases you can enhance performance by choosing to create these folders in another location. You can choose to install them on any local disk drive. You can choose different locations on each processing server. The folders are defined as follows: 24 User Guide

41 Logging MailMarshal uses this folder to hold text logs that provide details of each action taken by each MailMarshal service. By default MailMarshal keeps these logs for five days. These files can be large when volume is high. Note Compressing this folder with Windows file system compression reduces the disk space required and does not materially affect performance in most cases. Do not use compression for any other MailMarshal folders. Queues MailMarshal uses this folder to hold messages that are awaiting processing or sending. In most cases these folders will not grow large. However in the event that MailMarshal cannot connect to upstream or downstream servers, the data in these folders can grow quickly. Unpacking MailMarshal uses this folder to unpack messages and extract their content, including attachments such as archive files. The size of this folder is relatively small. Because MailMarshal will create and delete files repeatedly, this area of the disk can become fragmented, which can have an adverse affect on other applications running on the server. You can improve performance by placing this folder on a separate physical disk drive to other MailMarshal components. Chapter 2 Planning Your MailMarshal Implementation 25

42 Quarantine MailMarshal uses this folder as the default location for all quarantine folders. MailMarshal will store all quarantined messages in subfolders of this folder. This includes any archived messages and messages in the Mail Recycle Bin. Ensure that the disk drive where this folder resides has enough free space to accommodate the messages. The space required will vary depending on retention policies for quarantined messages. You can move individual folders to physically separate places on the server. For more information see Folders on page 155. Note MailMarshal will not accept new messages if there is less than 100MB of free disk space available for the Queues, Unpacking, or Quarantine folders, or 10MB for the Logging folder. Gathering Information Before Installation Before beginning installation of MailMarshal, you should gather information about the environment. This information will be needed to configure MailMarshal, and to configure other settings so that messages pass through MailMarshal. For detailed information about how to configure MailMarshal, see Chapter 3, Installing MailMarshal and Chapter 9, Managing MailMarshal Configuration. Information you should gather includes: The organization's Internet domain name(s) (for example ourcompany.com). Names of any other local domains or subdomains for which MailMarshal will process (for example oursubsidiaries.com, pop.ourcompany.com). Contact information for the DNS server administrators of domains for which MailMarshal will process . If the MailMarshal installation will require changes to DNS settings, determine the time required to make and propagate these changes. 26 User Guide

43 Contact information for the administrator of the firewall, if there is one. If the MailMarshal installation will require changes to firewall settings, determine the time required to make these changes. The IP address of the existing local server. The administrator's address. The virus scanning software (with an appropriate license) to be used with MailMarshal. The outbound delivery method now in use. Determine what changes, if any, will be required. The inbound delivery method now in use. Determine what changes, if any, will be required. The IP addresses of DNS servers MailMarshal should use to look up Internet information. If prerequisite software must be installed and systems must be restarted, determine the best time to restart these systems. Chapter 2 Planning Your MailMarshal Implementation 27