Email Security: Creating a Firewall Access Rule Routing SMTP Traffic to a SonicWall Email Security

03/26/2020 11 13855

DESCRIPTION:
Email Security: Creating a Firewall Access Rule Routing SMTP Traffic to a SonicWall Email Security Appliance

RESOLUTION:

In order To filter and monitor mail with a Sonicwall Email Security appliance, it is necessary to re-route mail traffic through the appliance. Mail traffic must pass from the Internet to the appliance, then the appliance sends the good mail on to your mail server. There are two ways to route the traffic:

1. Change the MX record of your domain to point to a public IP address assigned to your Email Security Appliance.
2. Create a rule on your firewall pointing the MX record IP address to the internal private IP address of your Email Security Appliance. For example, to create a rule on a SonicWall firewall running SonicOS Standard firmware:
   1. Select the Firewall > Access Rules page.
   2. Click Add, and specify the following rule:
      • Action: Allow
      • Service: Send Email (SMTP)
      • Source: WAN
      • Addr Range Begin: *
      • Addr Range End: left blank
      • Destination: LAN
      • Addr Range Begin: Email Security Appliance IP address
      • Addr Range End: left blank
      • Users Allowed: ALL
      • Schedule: Always on
   3. Check Allow Fragmented Packets.
   4. Enter an appropriate description of this rule in the comment field.
   5. Leave remaining settings at their defaults.
   6. Click Update.
3. If the appliance is in the DMZ and the E-Mail server is on the LAN, then change the destination network in the rule to DMZ and create a second rule allowing SMTP from DMZ to LAN.

To verify the settings are correct:

1. Go to an external mail account (like Yahoo mail).
2. Create an email message with the following content:
   • To: (Use Email address on your network)
   • Subject: Email Security Verification Message
   • Body: Email Security Verification Message
3. Send the message.
4. In the administrative interface of the Email Security Appliance, click Auditing.
5. Check Inbound auditing reports to make sure email appears as Delivered.
6. Check the mail account to which you sent the message. If the message is received, the Email Security Appliance is correctly configured.