United Kingdom Endpoint Management User Group

Dear All,

i  want to install Symantec Mail Security for Exchange 2010 i have Some Question...

- Where i have to install it ( i mean which Role) the exchange 2010 design like below,,,

- i have DAG in Exchange 2010

- i have NLB between two HUB/CAS

- What i have to configure inside the mail Security ( Important Rule)

Hi odweik@qdsnet.com,

SMSMSE 6.5.2 is 100% supported for Ex2010 and DAG.  The answers that you are looking for can be found by reading the following articles:

Installation walkthrough for Symantec Mail Security for Microsoft Exchange on an Exchange 2007 or 2010 server (http://www.symantec.com/docs/TECH140532)

System Requirements for Symantec Mail Security 6.5 for Microsoft Exchange on Microsoft Exchange Server 2010/Server 2007 (http://www.symantec.com/docs/TECH97473)

https://www-secure.symantec.com/connect/forums/sms-v65-exchange-2010-which-servers-need-smsmse-when-roles-are-divided-between-servers

There have also been some other forum posts where mail admins have made recommendations about architecture.  Definitely worth searching out and reading!

Hope this helps- please let the forum know if this solves your question or if there is anything additional that we can help with.

Mick

Dear Mike,

Thanks for your help but what about install SEP Client in Exchange 2010 Server

Thanks

Hi Omar,

The latest release of the SEP client, SEP 11 RU6 MP1, will automatically detect the presence of Ex2010 and create the necessary exclusions. 

See Preventing Symantec Endpoint Protection 11.0 from scanning the Microsoft Exchange 2010 directory structure (http://www.symantec.com/docs/TECH97707) for full details.

Thanks again,

Mick

Dear Mark,

Again Thanks but i still i have last answer where i have to install SMS for Exchange 2010 in HT/CAS or Mailbox Server

Thanks

Hi Omar,

SMSMSE 6.5 can be installed on the EDGE role, MBX (maillbox) or HUB (Hub) role.  It cannot perform any scanning on UM or CAS. 

I recommend installing it on the edge and hub and configuring it for anti-spam and anti-virus, and on the mailbox server for just AntiVirus.

Thanks again,

Mick

Dear Mike,

What do you mean by just antivirus in mailbox?  (just install SEP Client in Mailbox without installing SMSMSE 6.5)

What is most important  poilicy i have to configure it inside the SMSMS

Really thank you and i hope some day meet you.

Thanks alot now i feel i have strong knowglde becouse of you .

Hi,

I think you make a mistake between SEP and SMSMSE. SEP is protecting the OS and the RAM of your machine. SMSMSE is looking for any threat inside the mail activity (SMTP and others).

It depends on what you desire to protect. The OS or the e-mail recipients ? To fully protect your Exchange server you need one SEP client and one SMSMSE server. As SEP client should be installed on any client of your network, you should be protected from outside and inside attack.

Hope its help you. Regards.

The above post is absolutely correct- the SEP client should be on all computers, including the Exchange servers.  It will keep the server itself protected.  SEP cannot scan the mail flow, though, or Exchange's mailbox databases.  SMSMSE is a product especially designed to read and scan that type of file.

Cheers again,

Mick

Dears,

Please sorrect if i'm wrong...

My Exchange Design .....

- Two Exchange 2010 HUB/CAS Server (installed in the Same Server with NLB)
- Two Exchange 2010 Mailbox Server with DAG

my setup will be like like below...

- Install SEP Client in the Four Exchange server with exculde some folder.

- Install SMSMSE in the HUB Server 1 as AntiSpam Soultion

- Install SMSMSE in the HUB Server 1 as AntiSpam Soultion

- Install SMSMSE in the Mailbox Server 1  as AntiVirus Soultion

- Install SMSMSE in the Mailbox Server as 2  AntiVirus  Soultion

Please waiting your Answer and Thanks you

Omar

Looks good, Omar!

My one recommendation: be sure SMSMSE's Auto-Protect is enabled on those HUBs as well. Any schedules scans of the mailbox databases, etc, should only occur on the MBX role servers.

If there are additional questions, please do ask away!  If not please do not forget to mark this thread solved.

Cheers again,

Mick

I don't recommend install SEP and SMSMSE on the same server. What reason to do this ? If your Exchange Server is accessible only by outlook clients and Webmail it means that nobody can write files into their file system, right ? Then, it's not mandatory install SEP on this server. 

Both softwares running under same machine can result in poor performance. 

Think About. 

Regards

Just a confirmation: both SEP and SMSMSE are necessary to keep the server secure.  They have been designed to work together and should not result in poor performance.

Keep in mind that SMSMSE provide anti-spam, content filtering and many otehr things that SEP does not.

Also keep in mind that worms can spread throughout an undefended network- including onto mail servers- without any usuer interaction.

To reiterate what Mick has said, many of the newer breeds of viruses spread via unpatched vulnerabilities in the OS/Software installed on the system, and do not even require a user to be logged on to the server. SMSMSE protects only the Exchange queues and databases, it does nothing to prevent file system virus activity, which is why we definitely recommend SEP to be installed on all machines in the network, even if SMSMSE is protecting Exchange itself.

While there are definitely steps you can take to mitigate the risk of an infection on the file system of your server (Do not allow users to log on directly, proper firewall rules and network segregation) these steps cannot cover every possible avenue of attack on your Exchange server.

What is most important Policy or Configuration  i have to configured inside the SMSMSE

We have a lot of important policies that need be implemented in SMS but I think that you need think to prevent mailboxes to receive some file types, like EXE, COM, BAT, SCR and so one. 

Other good idea is limit size of your messages. A lot of users have sense about size... like 1MB and 100Mb is the same... 

SPAM is SPAM !!! I have been see a lot of people that identify SPAM (Not suspect SPAM) and send these messages to quarantine :(.  Symantec says that they have 99,9% of acuracy to detect SPAM and this is true, then, you can delete these SPAM messages without problem. 

Right ?

Cheers

Hi Omar,

Just a proactive check to see how SMSMSE is working for you.  details usage instructions (as I am sure you have discovered) can be found in the .pdf's and in the Help.

Please let the forum know if you have any additional concerns or if your question has been solved! 

Thanks and best regards,

Mick

dear Mike ,

almost finish thanks

Dear All and Mike,

if i installed the SMSMSE6 in Exchange Mailbox role as Antivirus scanner what policy i have to configured

Thnaks 

Hi Omar,

It can be configured many ways- the default settings will provide auto-protect again AV threats in the mail stream, etc. I recommend reading the admin guide (.pdf) that is on the product CD for full details on how to configure background scanning, outbreak management, notifications, etc.  All the details are within.

Hope this helps!

Thanks and best regards,

Mick