ESA to be used as UAT SMTP

[sachin garg]

We would like to leverage the existing ESA to be used as a UAT SMTP, but we want to restrict emails from the UAT application to send out to external (Internet) while maintaining production emails to send to external. Could you please advise how do we achieve these?

OS version - 15.0.2-034

[Ken Stieers]

Assuming the mail coming out of the UAT servers looks JUST LIKE mail coming out of the production servers other that what IP/Hosts it comes from, and that you have an inbound listener and an outbound listener, I'd do the following:

1. Under Mail Policies/HAT Overview, pick the outbound listener, add a sender group above the RelayList sender group, with all of the same settings, except it has the IPs of all of your UAT boxes.
2. Create a message filter (in the CLI) that checks if mail hits that sender group and is going to OUTSIDE email address, it drops it.
Something like
if ((sendergroup == "UATServers") AND (rcpt-to !='domain.com'))
{
Drop();
}


That would need some testing with a result other than Drop before I put DROP I place...

If your UAT servers have from addresses that are unique to them, it would be better to build an outgoing mail policy where if the sender is a UAT address, and its NOT an internal address/domain, then have a content filter that drops everything... That way INTERNAL mail from UAT would still get delivered.

I'll post pics of what that would look like in a bit.

[sachin garg]

Thank you for the above information, however is it possible to provide any concrete document to support these steps?

SO that I should be able to refer the steps along with the document and come back here for the confusion.

[Ken Stieers]

Can you answer a few questions so we make sure we give you proper guidance?

1. Are the UAT servers sending mail that might have internal and external recipients?  Are those separate emails or the same email with internal and external emails on TO: line?

2. are the UAT servers using a FROM address that is unique to the UAT servers?  or are they using the same email addresses as production?

[sachin garg]

1. Are the UAT servers sending mail that might have internal and external recipients? – Yes, it may have. Thus we need to block it from sending email to external.
2. Are those separate emails or the same email with internal and external emails on TO: line? – Usually, it is.
3. Are the UAT servers using a FROM address that is unique to the UAT servers?  or are they using the same email addresses as production? – It will use a different FROM address for UAT. But we do not want to block it using the FROM address as it may not be effective if they changed the address later (application team will have control on this)

Kindly help me know the steps now.

[Ken Stieers · Accepted solution]

Assuming you just want all mail from the UAT boxes dropped:
Under Mail Policies/Hat Overview, select the "Outbound" listener...you'll have one sender group, called "RELAYLIST", Add another
Click on Add Sender group
Name it UATSERVERS
Set the ORDER to 1
Set the Policy to BLOCKED
Click Submit
Click on the UATSERVERS name in the list
Click Add Sender to add the IPs of your UAT servers.


IF you need the mail to internal users delivered and the mail to EXTERNAL users dropped, it's a bit more complicated.
Since you have addresses on the TO line that might be both external and internal, and you need to splinter the mail. (splintering processes a separate copy for different policies)
The only way to do that is via policy, and that can only work based on the From/To address combinations... (hence all of my questions)...

Under Mail Policies/Outgoing Content filters create a filter with NO criteria, but a DROP action.
Under Mail Policies/Outgoing Mail Policy, create a mail policy where the sender is your UATServer email addresses, and the recipients is a list of your internal domains that may need this mail.
Set the actions for that mail to be defaults
Create a second Outgoing Mail Policy below the one you just created, but above default. Set the Senders to be the same list of UAT addresses, and leave the recipient blank.
Turn off all of the security engines (Anti-spam/Anti-virus/etc), and add the one content filter you created above to drop the mail. (don't need to scan mail you're dropping anyway)









________________________________

This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited.
If you have received this communication in error, please immediately notify us by telephone and return the original message to us at the listed email address.
Thank You.