SonicWALL Email Security 7.0 8000 User manual

EMAIL SECURITY SonicWALL Email Security
SonicWALL Email Security
Solutions
SonicWALL
Email Security 7.0
8000
Getting Started Guide

Getting Started Guide 7.0 |1
SonicWALL Email Security 8000
Getting Started Guide
This Getting Started Guide contains installation procedures and configuration guidelines for
deploying a SonicWALL Email Security appliance on your network.
SonicWALL Email Security provides effective, high-performance, and easy-to-use inbound and
outbound email threat protection. Ideal for the small to medium size business, this self-running,
self-updating appliance delivers powerful protection against spam, virus and phishing attacks in
addition to preventing leaks of confidential information. Combining anti-spam, anti-phishing,
content filtering, policy management and content compliance capabilities in a single seamlessly
integrated solution, SonicWALL Email Security provides powerful protection without complexity.
Note:
z SonicWALL TotalSecure Email provides complete protection from spam, virus attacks and
phishing. Without TotalSecure Email, you must have a subscription to SonicWALL Email
Protection and Dynamic Support to use the spam and phishing protection provided by the
SonicWALL Email Security appliance. To purchase a subscription, contact your SonicWALL
vendor.
Please read this entire Getting Started Guide before setting up your
SonicWALL Email Security 8000 appliance.
An updated version of this guide may exist. Refer to SonicWALL’s Documentation Web site for
complete, updated documentation at: <http://www.sonicwall.com/Support.html>.

2|Email Security Software
Contents
This document contains the following sections:
Before You Begin
{ “Check Package Contents” on page 3
{ “What You Need to Begin” on page 4
{ “Record Configuration Information” on page 4
{ “Overview of the SonicWALL Email Security Appliance” on page 6
Registering Your SonicWALL Email Security Appliance
{ “Before You Register” on page 7
{ “Creating a mysonicwall.com Account” on page 7
{ “Registering Your SonicWALL Email Security Appliance” on page 8
Initial Setup and Configuration
{ “Apply Power to the SonicWALL Email Security” on page 9
{ “Connect Directly to the SonicWALL Email Security Appliance” on page 9
{ “Login to the SonicWALL Email Security Appliance” on page 9
{ “Initial System Configuration” on page 10
{ “Activating the Email Security License Subscriptions” on page 12
Connecting and Configuring Network Settings
{ “Connecting the SonicWALL Email Security to Your Network” on page 13
{ “The SonicWALL Email Security Interface” on page 14
{ “Changing the Default Administrator Password” on page 14
{ “Using Quick Configuration to Set Up Email Management” on page 15
Verification and Further Configuration
{ “Routing Mail to Your SonicWALL Email Security” on page 17
{ “Verifying Mail from the Internet Through Your SonicWALL Email Security” on page 17
1
2
3
4
5

Getting Started Guide 7.0 |3
Before You Begin
Check Package Contents
 One SonicWALL Email Security appliance
 One Getting Started Guide document
 One Release Note document
 One Thank You card
 One SonicWALL Resource CD
 One crossover cable (red)
 One Ethernet cable (gray)
 One RS232 CLI cable
 Two standard power cords*
 One Y-Split power cable*
 One Rack mount Kit (not pictured)
*The included power cords are intended for use in North America only. For European Union (EU)
customers, power cords are not included.
*Das eingeschlossene Netzkabel ist für Gebrauch in Nordamerikas nur vorgehabt.
Für Europaïsche Union (EU) Kunden, ist ein Netzkabel nicht eingeschlossen.
1
Any Items Missing?
If any items are missing from your package,
contact:
SonicWALL Support
<http://www.sonicwall.com/us/Support.html>
Email: [email protected]

Page 4 Getting Started Guide 7.0
What You Need to Begin
z A computer to use as a management station for initial configuration of SonicWALL Email
Security software
z Internet Explorer 5.0 or higher
z An Internet connection
Record Configuration Information
Before continuing, record the following configuration information for your reference:
Registration Information
Networking Information\
Serial Number:
(xxxxxx-xxxxxx)
Record the serial number found on
the top right access panel of your
SonicWALL Email Security appli-
ance.
Authentication Code:
(xxx-xxx)
Record the authentication code
found on the top right access panel
of your SonicWALL Email Security
appliance.
E m a i l S e c u r i t y I P A d d r e s s :
Select a free static IP address for
your
SonicWALL Email Security appli-
ance that is within the range of your
local subnet.
E m a i l S e c u r i t y S u b n e t M a s k :
Enter the subnet mask for the local
subnet where you are installing
your SonicWALL Email Security
appliance.
G a t e w a y I P A d d r e s s :
Record the IP address of your net-
work’s
gateway device (such as your
perimeter
firewall/router).
DNS Server 1:
D N S S e r v e r 2 ( o p t i o n a l ) :
Record your DNS Server informa-
tion.
Host Name:
Record the fully qualified domain
name within your network for your
SonicWALL Email Security appli-
ance (maximum 32 characters).

Getting Started Guide 7.0 |5
Password:
Select a password for your Son-
icWALL Email Security appliance
(default is password).
Email Server IP: Record the IP address or hostname
of your email server.
LDAP Server IP:
Record the IP address or hostname
of your directory services server,
such as LDAP or Microsoft Active
Directory.

6|Email Security Software
Overview of the SonicWALL Email Security Appliance
SonicWALL Email Security Appliance
* Alerts are explained in detail in light path diagnostic panel. To access, push the diagnostic panel
release latch to the left and pull out the panel.
Alert: Do not plug devices into any ports (other than those indicated) unless
explicitly instructed to do so by a SonicWALL technical support
representative. Doing so may void your warranty.
LAN Port
Power Supply 1
Power Supply 2
Serial Port
Power Button Alert LED*
HDD LED
Power LED Diagnostic Panel Release
SCSI Drive 1 SCSI Drive 2
SCSI Drive
Bays
Allows SCSI drives in a RAID array to be hot-swapped should one
drive fail.
Power LED Indicates the SonicWALL Email Security appliance is powered on.
Power Button Allows the SonicWALL Email Security appliance to power on or off.
Diagnostic
Panel
Can be pulled out (push release lever to the left) for detailed expla-
nation of alerts.
Alert LED Indicates an alert. See Diagnostic panel for more information.
HDD LED Indicates data transfer to and from the hard disk drive.
LAN Port Allows the SonicWALL Email Security appliance to connect to your
local area network or management station.
Serial Port Allows direct connection to the appliance via terminal services to
use the CLI.
Power Supplies Two power supplies allow the SonicWALL Email Security appliance
to utilize redundant AC power using the supplied power cables.

Getting Started Guide 7.0 |7
Registering Your SonicWALL Email Security Appliance
Register your appliance and activate your licenses for the SonicWALL Email Protection Subscription
and Dynamic Support.
This section contains the following sub-sections:
{ “Before You Register” on page 7
{ “Creating a mysonicwall.com Account” on page 7
{ “Registering Your SonicWALL Email Security Appliance” on page 8
Before You Register
You need a mysonicwall.com account to register the SonicWALL Email Security appliance. To create
a mysonicwall.com account, refer to “Creating a mysonicwall.com Account” on page 7. If you
already have a mysonicwall.com account, go to “Registering Your SonicWALL Email Security
Appliance” on page 8 to register your appliance.
Note:
z mysonicwall.com registration information is not sold or shared with any other company.
Creating a mysonicwall.com Account
Creating a mysonicwall.com account is fast, simple, and FREE. Simply complete an online
registration form.
1. In your Web browser, go to <https://www.mysonicwall.com/>.
2. In the User Login section, click If you are not a registered user, Click here.
3. Enter the account information, personal information, and preferences and click Submit.
You must enter a valid email address.
4. Follow the prompts to finish creating your account. SonicWALL will email a subscription code to
the email address you entered in the personal information.
5. When you return to the login screen, log in with your new username and password.
6. Confirm your account by entering the subscription code you received by email.
Congratulations! You have created and logged into your mysonicwall.com account.
2

8|Email Security Software
Registering Your SonicWALL Email Security Appliance
1. Locate your SonicWALL Email Security Software serial number. It is printed on the label on the
top right access panel of your SonicWALL Email Security Appliance.
2. If you are not already logged into mysonicwall.com, go to
<https://www.mysonicwall.com/> and log in.
3. Enter your serial number in the Quick Register field and click the Next button. Follow the on-
screen instructions.
4. Confirm your serial number, enter a friendly name for your appliance, and enter your
authentication code in the Quick Register > Add New Product section.
5. Click Register.
6. Follow the online prompts to fill out the survey and complete the registration process.

Getting Started Guide 7.0 |9
Initial Setup and Configuration
This section contains the following sub-sections:
z “Apply Power to the SonicWALL Email Security” on page 9
z “Connect Directly to the SonicWALL Email Security Appliance” on page 9
z “Login to the SonicWALL Email Security Appliance” on page 9
z “Initial System Configuration” on page 10
z “Activating the Email Security License Subscriptions” on page 12
Apply Power to the SonicWALL Email Security
1. Connect the included standard power cord with the y-split power cord.
2. Plug each of the y-split ends into a power supply on the back of the SonicWALL Email Security
appliance.
3. Plug the power cord into an appropriate power outlet.
4. Press the recessed power button on the front bezel to power on the appliance. The entire
sequence may take several minutes to complete.
The Power LED on the front panel lights up green when you power on the SonicWALL Email
Security appliance. The HDD LED lights up and may blink while the appliance performs a series
of diagnostic tests. When the HDD LED is no longer lit, the SonicWALL Email Security appliance is
ready for configuration.
If the Alert light stays lit, ensure that BOTH of the power supplies on the back of the SonicWALL
Email Security Appliance are plugged in (use the included y-split cable for this purpose).
Connect Directly to the SonicWALL Email Security Appliance
The SonicWALL Email Security appliance comes pre-configured with an IP address of
192.168.168.169. Before you can connect your administration station to it, you must configure
your administration computer to have an address in the same subnet.
1. Make a note of your computer’s current network settings.
2. Set the computer you use to manage the SonicWALL Email Security appliance to have a static
IP address in the 192.168.168.x range, such as 192.168.168.50 and a netmask of
255.255.255.0. For help with setting up a static IP address on your computer, refer to
“Troubleshooting” on page 20.
3. Using the supplied crossover cable and the administration computer, connect the computer’s
LAN port to the LAN (1) port on the back of your SonicWALL Email Security appliance.
Login to the SonicWALL Email Security Appliance
1. Open a Web browser on the administration computer.
2. Enter http://192.168.168.169 (the default IP address of the SonicWALL Email Security
appliance) in the Location or Address bar. The SonicWALL Email Security Web management
login screen displays.
3

10 |Email Security Software
Note:
z Depending on your browser settings, one or more security warnings may display while
connecting to the Email Security Web management interface. Choose to accept the certificates
in order to log into the SonicWALL Email Security appliance.
3. Log into SonicWALL Email Security appliance using “admin” as the user name and
“password” as the password.
Initial System Configuration
1. The first time you log in to the SonicWALL Email Security appliance, you are directed to the
system configuration page. Configure your settings as follows:

Getting Started Guide 7.0 |11
Monitoring
Hostname and Networking
Date and Time
Email address of
the administrator
who receives
emergency alerts:
The email address of the mail server administrator.
Enter the complete email address.
For example, [e-mail]
Postmaster for the
MTA:
The email address of the Mail Transfer Agent
administrator who will receive non-deliverable
receipts.
For example, [email protected]
Name or IP
address of backup
SMTP servers:
Enter fully qualified domain names or IP
addresses.
For example, mail2.example.com or 10.100.0.1
Hostname: Enter a hostname you can use within your network to
address the SonicWALL Email Security appliance.
Enter a fully qualified domain name.
For example, emailsecurity.example.com
Get all network
settings from
DHCP:
Select this if you want your SonicWALL Email Secu-
rity appliance to get dynamic IP settings from the
DHCP server on your network.
Use the static set-
tings below:
Select this to assign your SonicWALL Email Security
appliance a static IP address.
Enter:
• This machine's IP address
• Primary DNS server IP address (the local DNS server
that has the MX record for your mail server)
• Fallback DNS server IP address
• Default gateway IP address
• Subnet mask
System Date and
Time:
Select the current year, month, day, hour, and
minute.
Current Time
Zone:
Displays the currently configured time zone.
Available Time
Zones:
Select the time zone for your area.
Automatically
Adjust for Day-
light Savings
Time:
Select this if your area observes Daylight Saving
Time.

12 |Email Security Software
Select the proper time zone to ensure optimal network performance of your SonicWALL Email
Security appliance.
1. Click the Apply Changes button to save this configuration.
2. A popup will display. Click the Continue button to reboot the SonicWALL Email Security
appliance with your new settings.
3. Disconnect the crossover cable from the SonicWALL Email Security appliance.
4. Reset your administration computer’s IP settings to work with your network. For example, if
your network uses DHCP, reset your Local Area Connection to obtain an IP address and DNS
settings dynamically from the server.
5. Reconnect your administration computer to your network. You will use the network to access
the SonicWALL Email Security appliance in the next steps.
Activating the Email Security License Subscriptions
SonicWALL Email Security provides dynamic licensing, which allows you to activate your licenses by
logging into your mysonicwall.com account. The mysonicwall.com server automatically uses the
serial number and authentication code that came with your Email Security appliance.
XTo purchase or upgrade your Email Security license subscriptions:
1. Log in to mysonicwall.com.
2. Choose My Products from the left navigation bar. The Add New Product page appears.
3. Enter your serial number, the friendly name if you wish, and choose the product group. The
serial number is found on the tri-fold postcard or email that confirmed your SonicWALL Email
Security order.
4. Click the Register button. The product is added to the list of your registered products. You
can then click on it to add or activate services.
5. You can check that the registration is correct by logging in to your SonicWALL Email Security
administration site and clicking System/License Management. All your license information
should be available. If it is not, click the Test Connectivity to SonicWALL button to check
that you are connected.
Note:
z If you purchased Total Secure Email, licensing is automatic and you do not need to take any
action at all to activate your licenses.

Getting Started Guide 7.0 |13
Connecting and Configuring Network Settings
This section contains the following sub-sections:
z “Connecting the SonicWALL Email Security to Your Network” on page 13
z “The SonicWALL Email Security Interface” on page 14
z “Changing the Default Administrator Password” on page 14
z “Using Quick Configuration to Set Up Email Management” on page 15
Connecting the SonicWALL EmailSecuritytoYourNetwork
Your SonicWALL Email Security appliance is designed to operate in most network setups with
minimal configuration. The diagrams below provide a “before” and “after” view of a network using
SonicWALL Email Security.
1. Plug one end of the provided Ethernet cable into the LAN port on the back of your SonicWALL
Email Security appliance.
2. Plug the other end of the cable into an open port on your network hub or switch.
Note:
z Your SonicWALL Email Security Appliance will perform better if you follow the shutdown
procedures when you need to power-down. To shut down your appliance, use the web interface,
or press the power button on the front of the appliance once. Holding down the power button
or unplugging your appliance does not give it time to write all the data in volatile memory to
stable memory, and you may lose settings or data.
4
Local
Clients
Incoming
Email
Outgoing
Email
Incoming
Email
Outgoing
Email
Mail Flow Before SonicWALL Email Security
Mail Flow After SonicWALL Email Security
EMAILSECURITY8000

14 |Email Security Software
The SonicWALL Email Security Interface
This section describes the SonicWALL Email Security user interface.
For a detailed SonicWALL Email Security user interface overview, refer to the SonicWALL Email
Security Administrator’s Guide.
Changing the Default Administrator Password
Change the default password for security reasons.
XTo change the default password:
1. Login to the SonicWALL Email Security appliance using the IP address you entered in
“Hostname and Networking” on page 11.
2. Enter a new management password into the Password field.
3. Navigate to the System > Administration page.
4. Enter it again in the Confirm Password field.
5. Click Apply Changes.
Click here to send a
message to SonicWALL
Technical Support Click here to get application
information
Click here to change
UI language
User’s role
User’s login

Getting Started Guide 7.0 |15
Using Quick Configuration to Set Up Email Management
The Quick Configuration page will walk you step-by-step through the configuration of your
SonicWALL Email Security appliance. Use this window the first time you configure SonicWALL Email
Security if you are installing SonicWALL Email Security as an All-In-One server and have only one
downstream server.
The information you enter for LDAP configuration is used to authenticate users as they log into their
personal Junk Boxes.
For detailed configuration instructions, refer to the SonicWALL Email Security Administrator’s Guide.
XTo use Quick Configuration:
1. Navigate to the System > Administration page.
2. Click Click Here for Quick Configuration.
3. In the Quick Configuration dialog box under Network Architecture, enter the host name or
IP address and the port into the Inbound destination server fields.
The inbound destination server is the email server that will accept good email after SonicWALL
Email Security removes and quarantines junk email. For example, this could be the IP address
of a Microsoft Exchange server. The default port is 25.
4. For Inbound SMTP setup, select one of the following:
{ Allow SMTP recipient addresses to all domains on inbound path or...
{ This option does not restrict incoming email to any domain.
{ Only allow SMTP recipient addresses to these domains on inbound path
This option allows you to specify the domains to which incoming email will be delivered. In
the text box, type the allowed domains one per line.
5. Click Test Mail Servers to verify connectivity to the downstream Email Security server
specified in preceding steps.
6. Select the Outbound path setup check box to route outbound email across the Internet
using MX records.
7. Under LDAP Configuration, enter a hostname or IP address into the LDAP server name field.
This is often your Exchange server or email server.

16 |Email Security Software
8. Select the type of LDAP server from the LDAP server type drop-down list.
9. Enter a valid LDAP login name and password into the Login name and Password fields. Click
What is this? for more information.
10. Click Test LDAP Login and Test LDAP Query to verify your settings.
11. Enter one or more NetBIOS domain name in the NetBIOS domain names field. Click What
is this? for more information.
12. Under Message Management, specify how junk mail will be handled by selecting one of the
following:
{ Quarantine junk - sends junk mail to the user’s junk box
{ Deliver all messages to users - does not separate junk mail from good email
13. Under Junk Box Summary, to send daily summary messages about junk mail caught by
SonicWALL Email Security, select Send daily summaries.
14. To allow users to preview their junk mail messages with unjunking them, select Users can
preview their own quarantined junk mail.
Summaries will contain a preview link for each junk email.
15. Type the URL where users can view their email junk boxes in the URL for user view field.
Click Test this Link to verify connectivity.
16. Under Updates, click Test Connectivity to SonicWALL to test your connection to
mysonicwall.com for automated software updates.
17. Click Apply Changes.

Getting Started Guide 7.0 |17
Verification and Further Configuration
This section contains the following subsections:
z “Routing Mail to Your SonicWALL Email Security” on page 17
z “Verifying Mail from the Internet Through Your SonicWALL Email Security” on page 17
z “Configuring Outbound Mail Filtering” on page 17
Routing Mail to Your SonicWALL Email Security
For your SonicWALL Email Security appliance to start filtering and monitoring mail, you must re-
route mail traffic through your SonicWALL Email Security appliance. Mail traffic must pass from the
Internet to the appliance, and then the appliance sends the good mail on to your mail server.
You have two choices to route mail traffic to your SonicWALL Email Security appliance instead of to
your mail server:
z Change the MX record in your DNS server to resolve to the IP address of your SonicWALL Email
Security appliance. You may have to work with your ISP to change this record.
z Create a rule in your firewall or router to route all port 25 (SMTP mail) traffic to your SonicWALL
Email Security appliance. Refer to your firewall or router documentation for instructions on
creating rules to route traffic.
Verifying Mail from the Internet Through Your SonicWALL Email Security
1. Go to an external mail account, for example Yahoo mail or GMail.
2. Create a new email message:
3. Send the message.
4. In the SonicWALL Email Security appliance administrative interface, click the Auditing button
on the top.
5. Check the Inbound auditing reports to make sure the email appears as Delivered.
6. Check the mail account you sent the message to. If you received the message, you have
correctly configured your SonicWALL Email Security appliance.
Configuring Outbound Mail Filtering
Your SonicWALL Email Security appliance can filter outbound mail from your mail server to the
Internet. To configure outbound mail filtering, you configure both your mail server and your
SonicWALL Email Security appliance for the outbound mail path.
Configure the outbound mail destination of your mail server to point to the IP address or host name
of your SonicWALL Email Security appliance. This is typically done by configuring a Smart Host on
your mail server.
The configuration steps for Exchange Server 2003 are provided here. See the documentation on
your mail server for specific instructions.
1. In the Exchange System Manager, navigate to Servers > [servername] > Protocols >
SMTP > Default SMTP Virtual Server (or active server instance).
5
To: An email address where you receive email that is
on the mail server for which you have configured
the SonicWALL Email Security appliance.
Subject: SonicWALL Email Security Verification Message
Body: SonicWALL Email Security Verification Message

18 |Email Security Software
2. Right-click Default SMTP Virtual Server, and select Properties.
3. Browse to the Delivery tab, and click the Advanced button.
4. In the Smart Host field, enter the FQDN on your SonicWALL Email Security appliance (such as,
esa.example.com). Note: The Exchange Server must be able to resolve this host name.
5. Click OK.
On your SonicWALL Email Security appliance, in the Server Configuration > Network
Architecture page, configure a separate, outbound path to handle the outbound email flow at the
appliance (if not already configured).

Getting Started Guide 7.0 |19
Configure the path to use the MTA (MX routing or SmartHost) under Destination of Path.
You need to configure something unique between the inbound and outbound path to distinguish
inbound from outbound mail flow. A very simple way to do this is to have them listen on different
ports or enter the IP address of the Exchange Server as the Source IP Contacting Path on the
outbound path.
Example
Given:
10.100.0.10: Exchange Server (exch1.example.com)
10.100.0.100: SonicWALL Email Security appliance (esa.example.com)
You might have two paths like this:
Source IP Listen On Destination
Inbound Any Any:25 (proxy) exch1.example.com:25
Outbound 10.100.0.10 Any:25 MX
In this scenario, any message that arrives at the SonicWALL Email Security appliance from
10.100.0.10 will be treated as an outbound message, handed off to the MTA component in the
system, which will deliver the message via MX-lookup on the domain in the TO field. Messages that
arrive at the SonicWALL Email Security appliance from any other IP address will be treated as an
Inbound message, and delivered directly to the Exchange server. The SonicWALL Email Security
appliance always gives preference to specific matches (for example an exact IP address match takes
precedence over “Any”).
Another example using port numbers to distinguish which path a message should take:
Source IP Listen On Destination
Inbound Any Any:25 (proxy) exch1.example.com:25
Outbound Any Any:2525 MX
Another alternative would be to assign your SonicWALL Email Security appliance multiple IP
addresses, and have it listen on one for inbound and one for outbound.
In all of the above cases, the admin will configure Exchange to deliver outbound email to the IP
address and port number where the SonicWALL Email Security appliance is listening for outbound
mail.
To test your SonicWALL Email Security appliance, click the Auditing button at the top of the
SonicWALL Email Security appliance user interface and search for your sent email to verify it has
been sent and received.