How to set up secure MAPI optimization on the ProxySG appliance

Products

• Asset Management Solution
• ProxySG Software - SGOS

Issue/Introduction

Before setting up secure MAPI optimization, make sure that the ProxySG appliance meets the following prerequisites:

• The ProxySG appliance must be running SGOS 6.2.x., 6.3.x, 6.4.x or 6.5.x.
• Secure ADN must configured. Secure MAPI can only be sent across secure ADN tunnels between devices on the ADN network.

To add the appliance to the domain and begin optimising traffic:

1. Configure the Outlook client to use Negotiate Authentication.
   • In Outlook 2007, select Tools > Account Settings > Email Account > More settings > Security.
     Ensure that Encryption is enabled. Make sure that Negotiate Authentication is selected (which is the default).
     Negotiate Authentication means that the client can negotiate both Kerberos and NTLM. 
     
   • In Outlook 2000 and 2003, the setting is Kerberos/NTLM Password Authentication. 
     Exchange Server negotiates Kerberos as preferred, which is the default setting.
2. To enable the Domain Controller (DC) to support Trust Delegation, make sure that it is running Windows Server 2003 or later and configure it with the correct domain functionality level.
   Select Admin Tools > Active Domains and Trusts. Right-click the Domain. Select Raise the Domain Functionality.
   
3. Make sure that the NTP on the ProxySG appliance and the DC are configured correctly and have the same Time.
4. The appliance must be configured to join the domain. Select Configuration > Authentication > Windows Domain and create a new alias for the Windows Domain (which is an independent name only used on the ProxySG appliance).
   1. On the Windows Domain tab, configure the ProxySG appliance to join the domain. Enter the DNS domain name (for example, bluecoat.local) and the Device name you want to assign the ProxySG appliance on the domain.
   2. Click Join.
   3. Enter admin user credentials.
   4. Click Apply to configure the NetBios name.
      The ProxySG appliance displays in the Users and Computers list on the DC.
      Note: The user account used to join the appliance to the domain must be able to read the userAccountControl, accountExpires, and passwordLastSet attributes of all the users that must be authenticated.
5. Configure trust delegation on the DC for the ProxySG appliance at the branch office. 
   1. On the DC, select Administrative Tools > AD users and Computers.
   2. Under Domain Name/Computers, double click the ProxySG appliance host to display the properties and click the Delegation tab.
   3. Select Use any authentication protocol.
                             
      
   4. Click Add; in Add Services click Users and Computers.
   5. In the Enter the object names to select field, enter the name of the Exchange Server for which the system will be trusted to delegate and click OK.
   6. In Add Services, click the Exchange MDB database that will be trusted for delegation and click OK.
       
      Repeat the two previous steps for any other endpoint Exchange Servers that accept MAPI connections.
      The ProxySG appliance must be trusted to authenticate Exchange users (clients) when they connect to the ProxySG appliance (NTLM).
6. Configure secure ADN on the Branch and core ProxySG appliances.
   1. In the Management Console, select Configuration > ADN > General > Device Security.
   2. Select the SSL Device Profile you want to use and enable Authorization, if desired. Do this for both devices.
   3. Configure ADN as desired (manager/backup manager, advertised routes, transparent or explicit, and so on).
   4. If using a self-signed certificate or another certificate signed by a root CA that the ProxySG appliance does not recognize as the SSL device profile for secure ADN, copy this certificate from the Keyring into the CA cert list on the other device.
      Then, add it to the CA certificate list on both devices.
      Secure ADN should be established.
7. Enable secure MAPI on the ProxySG appliance.
   Select Configuration > Proxy Settings > MAPI proxy. Ensure that Enable acceleration for encrypted MAPI is selected and that the Domain Alias is selected from the drop-down list.

Note: The ProxySG must be joined to the same domain of which the Exchange Server is a member. Outlook users must belong to the same domain tree as the Exchange Server and the ProxySG appliance. SGOS 6.2.3.1 and later supports multi-domains. If all the domains are members of the same domain tree in one forest and there is a Parent/Child, a two-way trust relationship exists between these domains. This release does not support multi-domain if the domains are in different domain trees but in same forest (without a trust relationship) or in different forests.