McAfee Email Gateway 7.0 Virtual Appliance Installation Guide Revision A

1Introduction to McAfee Email Gateway Virtual ApplianceMcAfee Email Gateway featuresFeatureDescriptionAnti-spamprotectionEmail Email Policies SpamReduce spam in SMTP and POP3 email traffic using: Anti-spam engine, the anti-spam, and anti-phishing rule sets Lists of permitted and denied senders McAfee Global Threat Intelligence message reputation to identifysenders of spam email messages Permit and deny lists that administrators and users can create using aMicrosoft Outlook plug-in (user-level only)Detect phishing attacks and take the appropriate action.EncryptionEmail EncryptionThe McAfee Email Gateway includes several encryption methodologies: Server-to-server encryption Secure Web Mail Pull delivery Push deliveryThe encryption features can be set up to provide encryption services to theother scanning features, or can be set up as an encryption-only server used justto encrypt email messages.McAfee GlobalThreatIntelligencefeedbackEmail Email Policies Policy Options McAfee GTI feedbackComplianceSettingsEmail Email Policies ComplianceSystem Setup WizardMcAfee analyzes data about detections and alerts, threat details, and usagestatistics from a broad set of customers to combat electronic attacks, protectvulnerable systems from exploit, and thwart cyber crime. By enabling thisfeedback service in your product, you will help us improve McAfee Global ThreatIntelligence, thereby making your McAfee products more effective, as well ashelp us work with law enforcement to address electronic threats.This release of the product includes enhancements to the way the applianceuses compliance rules: In the Compliance policy, use the Rule Creation wizard to specify the inbuiltdictionaries that you want to comply with, or create the a new rule using anexisting rule as a template. Use the Mail size filtering and File filtering policies to check SMTP email messagesfor true file types and take action on email based on size and number ofattachments.Data LossPreventionEmail DLP and ComplianceMessage SearchReports Message searchUse the Data Loss Prevention policy to upload and analyze your sensitivedocuments — known as training — and to create a fingerprint of each document.From a single location within the user interface, Message Search allows you toconfirm the status of email messages that have passed through the appliance.It provides you with information about the email, including whether it wasdelivered or blocked, if the message bounced, if it was quarantined, or held in aqueue pending further action.10McAfee Email Gateway 7.0 Virtual ApplianceInstallation Guide

Introduction to McAfee Email Gateway Virtual ApplianceMcAfee Email Gateway featuresFeatureDescriptionQuarantinefeaturesEmail Quarantine Configuration Quarantine Options1 Quarantine digests — Allow users to handle quarantined items without involvingthe email administrator. McAfee Quarantine Manager — Consolidate quarantine management for McAfeeproducts.Message Transfer Reroute traffic on-the-fly based on criteria set by the administrator. ForAgentexample, encrypted mail can be rerouted for decryption. Allow the administrator to determine the final status of each message. See a quick view summary of inbound email messages by domain withdrill-down facilities per domain and undeliverable email by domain. Prioritize the redelivery of undeliverable email based on domain. Pipeline multiple email deliveries to each domain. Rewrite an email address on inbound and outbound email based on regularexpressions defined by the administrator. Strip email headers on outbound messages to hide internal networkinfrastructure. Deliver messages using TLS. Manage certificates.Reporting and System featuresFeatureDescriptionScheduledReportsReports Scheduled ReportsLogging optionsSystem Logging, Alerting and SNMPSchedule reports to run on a regular basis and send them to one or more emailrecipients.You can configure the appliance to send emails containing information aboutviruses and other detected threats, and to use SNMP to transfer information fromyour stratormanagement ofappliancesSystem Setup WizardThe Dashboard provides a single location for you to view summaries of theactivities of the appliance, such as the email flowing through the appliance, andthe overall system health of the appliance. You can also go directly to areas ofthe user interface that you often use.Choose the ePO Managed Setup option to monitor the status of your appliances andalso manage your appliance from ePolicy Orchestrator.You can directly manage your appliances from ePolicy Orchestrator, withoutneeding to launch the interface for each appliance.In ePolicy Orchestrator, the user interface pages that you use to configure andmanage your appliance have a familiar look-and-feel to the pages that you findwithin the appliances.McAfee Email Gateway 7.0 Virtual ApplianceInstallation Guide11

1Introduction to McAfee Email Gateway Virtual ApplianceWhat you get in the download packageFeatureDescriptionClusterManagementSystem System Administration Cluster ManagementCluster management enables you to set up groups of appliances that worktogether to share your scanning workloads, and to provide redundancy in theevent of hardware failure.From these pages you can back up and restore your configurations, pushconfigurations from one appliance to others, and set up load balancing betweenyour appliances.Virtual HostsSystem Virtual Hosting Virtual HostsFor the SMTP protocol, you can specify the addresses where the appliancereceives or intercepts traffic on the Inbound Address Pool.Using virtual hosts, a single appliance can appear to behave like severalappliances. Each appliance can manage traffic within specified pools of IPaddresses, enabling the appliance to provide scanning services to traffic frommany customers.Role-basedAccess ControlSystem Users Users and RolesSystem Users Login ServicesIn addition to the Kerberos authentication method, RADIUS authentication is alsoavailable.What you get in the download packageThe McAfee Email Gateway Virtual Appliance 7.0 is supplied in a zip file that contains the softwareinstallation files and installation documents to install the virtual appliance on VMware vSphere 4.x.The download package does not contain the VMware product installation files. If you do not alreadyhave your virtual software set up, go to the VMware website (http://www.vmware.com) to purchaseVMware vSphere, or VMware vSphere Hypervisor (ESXi).12McAfee Email Gateway 7.0 Virtual ApplianceInstallation Guide

2Preparing to installTo ensure the safe operation of McAfee Email Gateway Virtual Appliance 7.0, consider the followingbefore you begin the installation. Familiarize yourself with its operational modes and capabilities. It is important that you choose avalid configuration. Decide how to integrate the appliance into your network and determine what information you needbefore you start. For example, the name and IP address for the device.ContentsInappropriate useConsiderations about network modesDeployment strategies for using the device in a DMZSystem requirementsSample installation scenariosInappropriate useUse this information to avoid using this product inappropriately.McAfee Email Gateway Virtual Appliance 7.0 is: Not a firewall — You must use it within your organization behind a correctly configured firewall. Not a server for storing extra software and files — Do not install any software on the deviceor add any extra files to it unless instructed by the product documentation or your supportrepresentative.The device cannot handle all types of traffic. If you use explicit proxy mode, only protocols that are tobe scanned should be sent to the device.Considerations about network modesUse this information to gain an understanding of the operational (or network) modes in which thedevice can operate.Before you configure your McAfee Email Gateway, you must decide which network mode to use. Themode you choose determines how you physically connect your VMware ESX host to your network.Different modes also have an impact on your vSwitch configuration to which your virtual appliance willbe connected to. Running the virtual appliance in explicit proxy mode requires the least amount ofconfiguration on your VMware ESX host and is easier to set up. To installing the virtual appliance ineither of the transparent modes, other considerations must be made. All necessary ESX configurationsteps for either of the modes are described below.McAfee Email Gateway 7.0 Virtual ApplianceInstallation Guide13

2Preparing to installConsiderations about network modesYou can choose from the following network modes: Explicit proxy mode — The virtual appliance acts as a proxy server and a mail relay. Transparent router mode — The virtual appliance acts as a router. Transparent bridge mode — The virtual appliance acts as an Ethernet bridge.If you are still unsure about the mode to use after reading this and the following sections, consult yournetwork expert.Explicit proxy modeUse this information to better understand explicit proxy mode on your McAfee Email Gateway.In explicit proxy mode, some network devices must be set up explicitly to send traffic to the device.The device then works as a proxy or relay, processing traffic on behalf of the devices.Figure 2-1 Explicit proxy mode — apparent data pathExplicit proxy mode is best suited to networks where client devices connect to the device through asingle upstream and downstream device.This might not be the best option if several network devices must be reconfigured to send traffic to thedevice.Network and device configurationIf the device is set to explicit proxy mode, you must explicitly configure your internal mail server torelay email traffic to the device. The device scans the email traffic before forwarding it, on behalf ofthe sender, to the external mail server. The external mail server then forwards the email message tothe recipient.In a similar way, the network must be configured so that incoming email messages from the Internetare delivered to the device, not the internal mail server.The device scans the traffic before forwarding it, on behalf of the sender, to the internal mail server fordelivery, as shown.For example, an external mail server can communicate directly with the device, although traffic mightpass through several network servers before reaching the device. The perceived path is from theexternal mail server to the device.ProtocolsTo scan a supported protocol, you must configure your other network servers or client computers toroute that protocol through the device, so that no traffic bypasses the device.Firewall rulesExplicit proxy mode invalidates any firewall rules set up for client access to the Internet. The firewallsees only the physical IP address information for the device, not the IP addresses of the clients, so thefirewall cannot apply its Internet access rules to the clients.14McAfee Email Gateway 7.0 Virtual ApplianceInstallation Guide

Preparing to installConsiderations about network modes2Ensure that your firewall rules are updated. The firewall must accept traffic from McAfee EmailGateway, but must not accept traffic that comes directly from the client devices.Set up firewall rules to prevent unwanted traffic entering your organization.Where to place the deviceConfigure the network devices so that traffic needing to be scanned is sent to the McAfee EmailGateway. This is more important than the location of the McAfee Email Gateway.The router must allow all users to connect to the McAfee Email Gateway.Figure 2-2 Positioning in Explicit proxy modeThe McAfee Email Gateway must be positioned inside your organization, behind a firewall, as shownin Figure 6: Explicit proxy configuration.Typically, the firewall is configured to block traffic that does not come directly from the device. If youare unsure about your network’s topology and how to integrate the device, consult your network expert.Use this configuration if: The device is operating in explicit proxy mode. You are using email (SMTP).For this configuration, you must: Configure the external Domain Name System (DNS) servers or Network Address Translation (NAT)on the firewall so that the external mail server delivers mail to the device, not to the internal mailserver. Configure the internal mail servers to send email messages to the device. That is, the internal mailservers must use the device as a smart host. Ensure that your client devices can deliver emailmessages to the mail servers within your organization. Ensure that your firewall rules are updated. The firewall must accept traffic from the device, butmust not accept traffic that comes directly from the client devices. Set up rules to preventunwanted traffic entering your organization.McAfee Email Gateway 7.0 Virtual ApplianceInstallation Guide15

2Preparing to installConsiderations about network modesTransparent bridge modeUse this information to better understand Transparent bridge mode on your McAfee Email Gateway.In transparent bridge mode, the communicating servers are unaware of the device — the device’soperation is transparent to the servers.Figure 2-3 Transparent bridge mode — apparent data pathIn the figure, the external mail server (A) sends email messages to the internal mail server (C). Theexternal mail server is unaware that the email message is intercepted and scanned by the device (B).The external mail server seems to communicate directly with the internal mail server — the path isshown as a dotted line. In reality, traffic might pass through several network devices and beintercepted and scanned by the device before reaching the internal mail server.What the device does in transparent bridge modeIn transparent bridge mode, the device connects to your network using the LAN1 and LAN2 ports. Thedevice scans the traffic it receives, and acts as a bridge connecting two network segments, but treatsthem as a single logical network.Configuration in transparent bridge modeTransparent bridge mode requires less configuration than transparent router and explicit proxy modes.You do not need to reconfigure all your clients, default gateway, MX records, Firewall NAT or mailservers to send traffic to the device. Because the device is not a router in this mode, you do not needto update a routing table.Where to place the device when using transparent bridge modeFor security reasons, you must use the device inside your organization, behind a firewall.Figure 2-4 Positioning in Transparent bridge modeIn transparent bridge mode, position the device between the firewall and your router, as shown.In this mode, you physically connect two network segments to the device, and the device treats themas one logical network. Because the devices — firewall, device, and router — are on the same logicalnetwork, they must all have compatible IP addresses on the same subnet.16McAfee Email Gateway 7.0 Virtual ApplianceInstallation Guide

Preparing to installConsiderations about network modes2Devices on one side of the bridge (such as a router) that communicate with devices on the other sideof the bridge (such as a firewall) are unaware of the bridge. They are unaware that traffic isintercepted and scanned, therefore the device is said to operate as a transparent bridge.Figure 2-5 Network structure — Transparent bridge modeTransparent router modeUse this information to better understand Transparent router mode on your McAfee Email Gateway.In transparent router mode, the device scans email traffic between two networks. The device has oneIP address for outgoing scanned traffic, and must have one IP address for incoming traffic.The communicating network servers are unaware of the intervention of the device — the device’soperation is transparent to the devices.What the device does in transparent router modeIn transparent router mode, the device connects to your networks using the LAN1 and LAN2 ports.The device scans the traffic it receives on one network, and forwards it to the next network device ona different network. The device acts as a router, routing the traffic between networks, based on theinformation held in its routing tables.Configuration in transparent router modeUsing transparent router mode, you do not need to explicitly reconfigure your network devices to sendtraffic to the device. You need only configure the routing table for the device, and modify some routinginformation for the network devices on either side of it (the devices connected to its LAN1 and LAN2ports). For example, you might need to make the device your default gateway.McAfee Email Gateway 7.0 Virtual ApplianceInstallation Guide17

2Preparing to installConsiderations about network modesIn transparent router mode, the device must join two networks. The device must be positioned insideyour organization, behind a firewall.Transparent router mode does not support Multicast IP traffic or non-IP protocols, such as NETBEUI andIPX.Firewall rulesIn transparent router mode, the firewall connects to the physical IP address for the LAN1/LAN2connection to the management blade.Where to place the deviceUse the device in transparent router mode to replace an existing router on your network.If you use transparent router mode and you do not replace an existing router, you must reconfigure partof your network to route traffic correctly through the device.Figure 2-6 Network structure — Transparent bridge modeYou need to: Configure your client devices to point to the default gateway. Configure the device to use the Internet gateway as its default gateway. Ensure your client devices can deliver email messages to the mail servers within your organization.VMware vSphere network configurationThis group of tasks presents how to prepare your vSwitch configuration for each of the operatingmodes available.18McAfee Email Gateway 7.0 Virtual ApplianceInstallation Guide

2Preparing to installConsiderations about network modesTask — Configure VMware vSphere for an explicit proxy mode installationUse this task to configure VMware vSphere to install the virtual appliance in the explicit proxy mode.Before you beginEnsure that you have at least two different physical interfaces available on your VMwareESX host. A third interface can be used for out-of-band mana

Encryption Email Encryption The McAfee Email Gateway includes several encryption methodologies: Server-to-server encryption Secure Web Mail Pull delivery Push delivery The encryption features can be set up to provide encryption services to the other scanning features, or can be set up as an encryption-only server used just