Sophos Email Appliance

315 Pages·2017·6.34 MB·English

Sophos Email Appliance
User Guide
Contents
About Your Email Appliance....................................................................................................................1
Email Appliance Features.............................................................................................................1
The Email Appliance User Interface.............................................................................................4
Sophos Proactive Monitoring........................................................................................................6
Getting Support.............................................................................................................................6
Getting Started.........................................................................................................................................8
Mail Routing...................................................................................................................................8
Policy...........................................................................................................................................11
Quarantine...................................................................................................................................12
Administrator and User Accounts...............................................................................................13
Email Appliance Updates............................................................................................................14
Clustering.....................................................................................................................................14
Email Appliance Hardware.....................................................................................................................16
Hardware Troubleshooting..........................................................................................................16
Replacing an ES5000/8000 Hard Drive......................................................................................16
Replacing an ES5000/8000 Power Supply.................................................................................20
Replacing an ES4000 Hard Drive...............................................................................................22
Replacing an ES4000 Power Supply..........................................................................................25
Dashboard..............................................................................................................................................28
Configuration..........................................................................................................................................32
Accounts......................................................................................................................................32
Policy...........................................................................................................................................40
System.......................................................................................................................................155
Routing.......................................................................................................................................198
Network......................................................................................................................................209
Reports.................................................................................................................................................214
Report Categories.....................................................................................................................214
Creating and Running Reports.................................................................................................216
Printing Reports.........................................................................................................................216
Exporting Reports......................................................................................................................216
Adding Trusted Relays from a Report......................................................................................217
Search..................................................................................................................................................218
Quarantine Search....................................................................................................................218
Logs Search..............................................................................................................................220
Mail Queues Search..................................................................................................................222
System Status......................................................................................................................................225
Mail Flow...................................................................................................................................225
Quarantine.................................................................................................................................226
Software.....................................................................................................................................226
Hardware...................................................................................................................................228
License.......................................................................................................................................229
Using Help............................................................................................................................................230
Searching the Documentation...................................................................................................230
Using the Table of Contents.....................................................................................................230
Getting Assistance.....................................................................................................................230
Viewing License/Version Information........................................................................................232
Setup and Configuration Guide...........................................................................................................233
Initial Configuration....................................................................................................................233
Post-Installation Configuration/Integration.................................................................................256
Configuring Ports..................................................................................................................................265
Supported Browsers.............................................................................................................................267
Creating a Custom Web Service for SPX...........................................................................................268
(2021/01/06)
Template Variables..............................................................................................................................269
Password Option/Template Variable Mismatches...............................................................................273
Dialog Box Help...................................................................................................................................274
Directory Services Groups........................................................................................................274
Add Certificate Authorities.........................................................................................................274
Complete CSR...........................................................................................................................275
Add User or Modify User..........................................................................................................275
Add Message Attribute..............................................................................................................276
Advanced System Updates.......................................................................................................277
Alias Map Editor........................................................................................................................277
Alert Contacts............................................................................................................................278
Appliance Support Contact........................................................................................................279
Additional Message Actions......................................................................................................279
Additional Policy Example.........................................................................................................281
Advanced Backup Schedule.....................................................................................................282
Calendar....................................................................................................................................282
Certificate Details......................................................................................................................283
Upload Certificate......................................................................................................................283
Edit notification email................................................................................................................284
Edit SPX Recipient Instructions................................................................................................284
Email Password List..................................................................................................................285
Configure End User Web Quarantine Ports..............................................................................285
Forward......................................................................................................................................286
Group Editor..............................................................................................................................286
Global Function History.............................................................................................................287
Upload a Header/Footer Image for the SPX Portal..................................................................287
Additional Network Routes........................................................................................................287
List Editor...................................................................................................................................288
List Selector...............................................................................................................................289
Upload........................................................................................................................................290
Message Details........................................................................................................................290
Modify User...............................................................................................................................291
Rule Caution Indication.............................................................................................................291
Notify..........................................................................................................................................292
Paste List...................................................................................................................................292
Upload a PDF Cover Page.......................................................................................................292
Postmaster Address..................................................................................................................293
CCL Configuration.....................................................................................................................293
Setting Expiry Times and Passwords.......................................................................................294
Configuring the SPX Portal.......................................................................................................294
System Alerts............................................................................................................................295
Trusted Certificate Authorities...................................................................................................295
Verify Settings...........................................................................................................................296
Glossary................................................................................................................................................297
Active Directory.........................................................................................................................297
allow list.....................................................................................................................................297
block list.....................................................................................................................................297
bulk mail....................................................................................................................................297
Cluster........................................................................................................................................297
Content Control List (CCL)........................................................................................................298
denial of service (DOS) attack..................................................................................................298
DHCP.........................................................................................................................................298
disk mirroring.............................................................................................................................299
DNS A Records.........................................................................................................................299
DNS MX Records......................................................................................................................299
domain controller.......................................................................................................................299
(2021/01/06)
End User Web Quarantine........................................................................................................299
gateway......................................................................................................................................299
groups........................................................................................................................................299
hub.............................................................................................................................................300
internal hosts.............................................................................................................................300
latency........................................................................................................................................300
malware.....................................................................................................................................300
MTA...........................................................................................................................................300
network mask............................................................................................................................300
phishing......................................................................................................................................301
policy..........................................................................................................................................301
proxy..........................................................................................................................................301
quarantine..................................................................................................................................301
RAID..........................................................................................................................................302
RAID controller..........................................................................................................................302
relay...........................................................................................................................................302
SCP............................................................................................................................................302
SMTP.........................................................................................................................................303
Sender Genotype......................................................................................................................303
SNMP.........................................................................................................................................303
SophosLabs...............................................................................................................................303
spam..........................................................................................................................................303
spam score................................................................................................................................303
spambot.....................................................................................................................................304
SPX............................................................................................................................................304
spyware......................................................................................................................................304
SSH............................................................................................................................................304
Syslog Monitoring......................................................................................................................304
TLS............................................................................................................................................304
virus...........................................................................................................................................305
Submit a Spam Sample.......................................................................................................................306
Sophos Outlook Add-in........................................................................................................................308
Using the Outlook Add-in..........................................................................................................309
Copyrights and Trademarks.................................................................................................................311
Third party legal notices......................................................................................................................312
IBM ICU License.......................................................................................................................312
SEE License..............................................................................................................................312
NGIX LICENSE AGREEMENT.................................................................................................314
ipfilter License............................................................................................................................315
Mootools License.......................................................................................................................316
SSDB License...........................................................................................................................317
Contact Sophos....................................................................................................................................318
(2021/01/06)
Sophos Email Appliance
1 About Your Email Appliance
The Sophos Email Appliance offers the best and most reliable gateway protection, while setting a
new standard for effective and efficient management. Sophos appliances draw on twenty years of
experience in enterprise threat management, delivering world-class threat protection in a compact and
easy-to-manage format.
The Sophos Email Appliance extends the power and performance of Sophos gateway security
software into the appliance form-factor. Sophos appliances provide award-winning integrated threat
management and a superior overall customer experience to deliver powerful, effective and reliable
gateway solutions for the enterprise.
1.1 Email Appliance Features
Enterprise-scale solution for organizations with up to 25,000 users
• On-Board Quarantine: The email quarantine resides on the same appliance where the mail is
filtered, translating into fewer infrastructure requirements, easier message handling, and a lower
total cost of ownership.
• Powerful Message Tracking: A multi-parameter search capability for tracking messages in system
logs and quarantine means that it’s easy to find and retrieve messages or trace their routing, with
less time spent searching for lost emails.
• Powerful Dashboard: Offers quick and comprehensive appliance management, monitoring and
reporting, making it easy to execute key tasks and run key reports.
• Built-In Hardware Redundancy: The ES4000, ES5000 and ES8000 come with dual hard drives,
power supplies and processors. Administrators can be confident that vital email systems will remain
running.
Threat Protection
• Reliable Protection Against Viruses, Spam, Spyware and Other Malware: Single-vendor
solution for better performance of all mission-critical functions, and one source for updates and
24/7 support.
Copyright © Sophos Limited 1
Sophos Email Appliance
• Powered by Sophos Labs: Proactive protection from an industry-leading worldwide network of
threat detection and analysis labs helps keep networks safe and clean 24/7, with reduced costs of
disinfection and repair.
• Optimized Operating System and Mail Transfer Agent: The entire infrastructure is tuned to work
seamlessly with the Sophos Email Appliance software, providing an integrated, hardened, and
reliable system.
• Preset Policy Choices: The ability to easily choose from several standardized email policy rule
sets means that less time is spent on system setup and administration.
• Sender Genotype service: Employs connection management technology to block email from bad
senders. Includes traditional IP reputation filtering as well as proactive connection control, which
blocks suspicious hosts. Sender Genotype eliminates up to 85% of inbound spam, substantially
increasing message throughput without the need for additional infrastructure investments.
• Real-Time Remote System Monitoring: Sophos Labs continuously monitors the system health
and status of all installed appliances to guarantee that your appliance is always up to date and
functioning properly.
• On-Demand Remote Assistance: A customer-enabled Secure Shell (SSH) connection provides
Sophos Labs with direct access to individual appliances for specific troubleshooting.
• Superior Support: Award-winning web-based, email and live telephone support available
24/7/365.
Glossary terms
quarantine (page 301)
The quarantine is a store of messages whose delivery has been blocked by policy rules.
spam (page 303)
Unsolicited email, often sent to millions of recipients at a time.
spyware (page 304)
Software that covertly gathers information on users’ internet activities.
malware (page 300)
Malware includes viruses, worms and Trojan horses.
SSH (page 304)
(Secure Shell) a program used for authentication and secure communication.
virus (page 305)
A malicious computer program that copies itself.
Sender Genotype (page 303)
2 Copyright © Sophos Limited
Sophos Email Appliance
A filtering technology designed to eliminate botnet spam at the IP-connection level. Sender Genotype
detects abnormal behavior from IP addresses that have not yet established a reputation, and
immediately blocks them from connecting to Sophos customers’ mail systems.
Copyright © Sophos Limited 3
Sophos Email Appliance
1.2 The Email Appliance User Interface
4 Copyright © Sophos Limited
Sophos Email Appliance
The Email Appliance user interface includes the following components:
1. The Status Information bar shows the following (from left to right):
• Remote Assistance session established is displayed while an outbound SSH connection to
Sophos Technical Support is open.
• Version number of the currently installed software.
• Logged in as <username> is displayed, indicating the username of the current user.
• Log Out can be clicked to exit from the Email Appliance user interface.
• The current time in 24-hour format.
2. The Navigation bar is used to access the Dashboard, Configuration, Reports, Search, Help and
System Status tabs.
3. The Content pane displays the pages of the Email Appliance user interface.
4. The Navigation sidebar only appears on the Configuration, Reports, and Search tabs. Click the
links on this sidebar to view the various configuration and reports options in the Content pane or,
on the Search tab’s sidebar, fill in the text boxes to perform a search.
5. The Content pane displays the pages of the Email Appliance user interface.
6. The Quick Tasks sidebar only appears on the Configuration tab. Click any of these links to
perform common configuration tasks.
Note
The interface for the Email Appliance is optimized for the latest supported browsers.
Related concepts
Dashboard Tab (page 28)
The Dashboard tab provides a quick overview of Email Appliance activity and status in six panels.
Configuration Tab (page 32)
The Configuration tab provides access to pages for setting system options and performing
administrative tasks.
Reports Tab (page 214)
The Reports tab provides performance statistics in the form of graphs and tables.
Search Tab (page 218)
Use the Search tab to search the quarantine and logs. Select the type of search to perform from the
top drop-down list on the Search In sidebar. Different Search Parameters are displayed, depending on
the type of search selected.
Help Tab (page 230)
The help system provides several tools for getting answers quickly while using the Email Appliance.
System Status Tab (page 225)
The System Status tab lets you monitor the health and performance of the Email Appliance.
Related reference
Supported Browsers (page 267)
Find out which web browsers Sophos Email Appliance supports.
Glossary terms
SSH (page 304)
Copyright © Sophos Limited 5
Sophos Email Appliance
(Secure Shell) a program used for authentication and secure communication.
1.3 Sophos Proactive Monitoring
Proactive Monitoring is a service that can be provided by Sophos to continuously monitor the system
health and status of your appliance. If there is ever a need to do so, Sophos will contact you and
advise you about what action may need to be taken to ensure the continued smooth functioning of
your appliance.
If your Email Appliance indicates that Sophos Proactive Monitoring is disabled, then you are not
subscribed to this service. To subscribe to the Sophos Proactive Monitoring service, contact your
Sophos representative.
Contact Sophos (page 318)
1.4 Getting Support
Sophos Email Appliances are equipped with advanced monitoring and assistance technologies that
deliver a superior customer support experience. Every installed appliance is kept up to date and at
its operational peak, with minimal administrative involvement. Using embedded technology, Sophos
appliances communicate with Sophos every five minutes, automatically receiving anti-virus and anti-
spam updates and optionally reporting on hardware health and protection status.
If required, you can send a support request directly from within the Email Appliance. Click the Help
button. Then, on the sidebar, click Sophos Support.
Sophos appliances also feature optional remote assistance via a secure, reverse tunnel SSH
connection. This lets customers grant Sophos Technical Support direct remote access to their
appliance for faster support resolution. Contact Sophos before enabling remote assistance.
Note
If you use your appliance in a clustered configuration, the reverse SSH connection will open to
whichever system you are currently logged into.
Active monitoring delivers automatic alerts on protection status, license validity and one-click
renewal/activation to system administrators.
Related information
Contact Sophos Technical Support
Glossary terms
Cluster (page 297)
Two or more Sophos Email Appliances that are connected on the same network as a group in order to
provide centralized management and redundancy.
SSH (page 304)
(Secure Shell) a program used for authentication and secure communication.
1.4.1 Hardware Support
All appliances carry a standard Advanced Replacement Warranty. Sophos will initiate the
replacement within two hours of a confirmed failure. Next-day delivery (not including delays from
6 Copyright © Sophos Limited