McAfee Gateway 7.x Encryption and IronPort Integration Guide

Transcription

1 Sample deployment architecture For this guide, we have provided a deployment architecture example. This example includes an IronPort Gateway sending outbound , and the McAfee Gateway Encryption (MEG) appliance revealing Push and Pull Encryption processes. The diagrams below illustrate the architecture used in this guide. Push Encryption Example: Secure Web Delivery (SWD) Push encryption refers to the ability to push an encrypted directly to the users inbox. Similar to Pull encryption, Push does not require users to install client software in order to read the encrypted message. In this model, users receive an message with an attachment, which is actually an encrypted file that contains the complete message. When users double-click on the attachment, it launches their Web browser where they are authenticated and the message can be displayed. From there, users can save attachments, as well as forward and reply. Pull Encryption Example: SWD Pull technology provides a way to deliver the encrypted message to users without requiring users to install client software to read the . Users receive a notification link message with only a link to the secure portal. When users click the link, they are sent to the portal where they are authenticated. From there, messages are decrypted, downloaded and presented via their Web browser. McAfee Gateway Encryption will allow users to compose a new message, or reply and forward the original message, thus providing full two-way secure communication. Page 1

2 Routing outbound messages to McAfee Encryption When outbound is sent from IronPort, it follows the defined default route for delivery to the recipient. At this time, TLS encryption may be negotiated for encryption, so long as the recipient supports TLS. If TLS cannot be negotiated during the SMTP session, the will be delivered insecurely via plain text. The following steps can be followed on the IronPort appliance to route messages to McAfee Gateway for full encryption, thus preventing plain text delivery of sensitive content: Outgoing Content Filters Navigate to Mail Policies > Outgoing Content Filters Click Add Filter to create a new entry Create the initial policy to identify outbound messages to deliver to MEG Encryption. Provide a name for the policy In the Description (optional) field, you may optionally add a rule description. For example: Route all outbound mail to MEG Encryption when message subject = [Secure] Click the Add Condition button to start creating the filter rule Many conditions can be used to create a filter for redirecting to MEG as an encryption server. One common condition is using a special subject string to initiate Encryption on demand when users define the message subject. In this example, the message subject to initiate encryption is [Secure]. Click OK to save changes Click the Add Action button to define what happens when the condition criteria are met To have sent to the MEG Encryption server, select Send to Alternate Destination Host Page 2

3 Enter the IP address (preferred) or Host Name of the MEG Encryption server in the Mail Host field Click OK Click Submit to create the filter rule Click Commit Changes in the upper right corner of the IronPort Administration console Enabling Content Filters for an Outbound Policy New filters are not applied to a policy by default, so it is necessary to assign the filter to an appropriate outbound mail policy. This example will use the Default Policy found in the IronPort Administration Console. Navigate to Mail Policies > Outgoing Mail Policies Use the Default Policy or use the Add Policy button to create a new one For this example, we will edit the Default Policy by clicking Disabled under Content Filters Clicking this link will open a new Mail Policies: Content Filters page as seen below: Page 3

4 Click the drop-down menu (default is Disable Content Filters ) Select Enable Content Filters (Customize settings) It is essential to check the Enable box for the filter to work properly Click Submit Click Commit Changes in the upper right corner of the IronPort Administration console You can optionally add a comment to why the changes were added to the system, and click Commit Changes again Other Configuration Notes Multiple Content Filter rules may be added to one outbound policy Multiple Outgoing Mail Policies can be assigned to a specific order Content filters are only limited to the conditions in the Add Condition window; however regular expressions are allowed in may areas Page 4

5 COPYRIGHT Copyright 2011 McAfee, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies. TRADEMARK ATTRIBUTIONS AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN, WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAF EE OR THE PLACE OF PURCHASE FOR A FULL REFUND. License Attributions Refer to the product Release Notes. Page 5