Firewall settings for Hosted Email Security to work with On-prem solutions

01/06/2021 53 People found this article helpful 198,761 Views

Download

Print

Translations

• Portuguese

Share

• LinkedIn
• Twitter
• Facebook
• Email
• Copy URL The link has been copied to clipboard

Description

In order for Hosted Email Security (HES) to work with On-prem solutions the Firewall will need the Nat Policies and Access Rules described below.

Resolution

Create the following in order of their appearance

Service Groups
1. LDAP and LDAPS 389 and 636

Address Objects

Create address object for the following Networks

1. Hosted IP a      173.240.210.0/255.255.255.0
2. Hosted IP b      173.240.213.0/255.255.255.0

4. Hosted IP c     173.240.214.0/255.255.255.0
3. Hosted IP d      204.212.170.0/255.255.255.0

Here is  sample.

The Above mentioned IPs for HES North America. If your are HES Europe tenant. There is only one range you must use

1.Hosted IP      173.240.221.0/255.255.255.0

4. Public IP SMTP       (Public IP SMTP)
5. Private IP SMTP      (Private IP of the SMTP server)
6. Public IP LDAP       (Public IP LDAP)
7. Private IP LDAP      (Private IP of the LDAP server)

Address Groups

Create an Address Group with the following IP Networks for North America.

1. Hosted IPs Hosted IP a, Hosted IP b, Hosted IP c Hosted IP d

Nat Policies
for SMTP traffic:

1. Any Original Public IP Private IP SMTP Original

for LDAP traffic:

2. Any Original Public IP Private IP LDAP+S Original

Access rules
1. Wan Lan Hosted IPs Public IP LDAP+S Allow

2. Wan Lan Any Public IP LDAP+S Deny

3. Wan Lan Hosted IPs Public IP SMTP Allow

4. Wan Lan Any Public IP SMTP Deny

NOTE:If you have other devices that need to access your LDAP from WAN to LAN outside of the hosted devices you will need to make sure those allow rules are prior to the deny all for LDAP

Related Articles

• Bandwidth usage and tracking in SonicWall
• How to force an update of the Security Services Signatures from the Firewall GUI
• Configure Guest VLAN in the TZ firewall, for guest users to access Internet only.

Categories

• Firewalls > TZ Series > Networking
• Firewalls > SonicWall NSA Series > Networking
• Firewalls > SonicWall SuperMassive 9000 Series > Networking
• Email Security > Hosted Email Security > Network Architecture