- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
Firewall settings for Hosted Email Security to work with On-prem solutions
01/06/2021 
50 People found this article helpful
45,401 Views
Description
In order for Hosted Email Security (HES) to work with On-prem solutions the Firewall will need the Nat Policies and Access Rules described below.
Resolution
Create the following in order of their appearance
Service Groups
1. LDAP and LDAPS 389 and 636
Address Objects
Create address object for the following Networks
1. Hosted IP a 173.240.210.0/255.255.255.0
2. Hosted IP b 173.240.213.0/255.255.255.0
4. Hosted IP c 173.240.214.0/255.255.255.0
3. Hosted IP d 204.212.170.0/255.255.255.0
Here is sample.
The Above mentioned IPs for HES North America. If your are HES Europe tenant. There is only one range you must use
1.Hosted IP 173.240.221.0/255.255.255.0
4. Public IP SMTP (Public IP SMTP)
5. Private IP SMTP (Private IP of the SMTP server)
6. Public IP LDAP (Public IP LDAP)
7. Private IP LDAP (Private IP of the LDAP server)
Address Groups
Create an Address Group with the following IP Networks for North America.
1. Hosted IPs Hosted IP a, Hosted IP b, Hosted IP c Hosted IP d
Nat Policies
for SMTP traffic:
1. Any Original Public IP Private IP SMTP Original
for LDAP traffic:
2. Any Original Public IP Private IP LDAP+S Original
Access rules
1. Wan Lan Hosted IPs Public IP LDAP+S Allow
2. Wan Lan Any Public IP LDAP+S Deny
3. Wan Lan Hosted IPs Public IP SMTP Allow
4. Wan Lan Any Public IP SMTP Deny
NOTE:If you have other devices that need to access your LDAP from WAN to LAN outside of the hosted devices you will need to make sure those allow rules are prior to the deny all for LDAP
Related Articles
- How can I configure a VPN between a SonicWall firewall and Microsoft Azure?
- Supported Public Cloud Servers/Instance Sizes on SonicWall NSv Series Models
- How to force an update of the Security Services Signatures from the Firewall GUI
Categories
- Firewalls > TZ Series > Networking
- Firewalls > SonicWall NSA Series > Networking
- Firewalls > SonicWall SuperMassive 9000 Series > Networking
- Email Security > Hosted Email Security > Network Architecture
YES
NO