User manual BARRACUDA SPAM VIRUS FIREWALL 4.X ADMINISTRATOR GUIDE

[. . . ] Firmware Version 4. x Barracuda Spam & Virus Firewall Administrator's Guide Barracuda Networks Inc. Winchester Blvd Campbell, CA 95008 http://www. barracuda. com Copyright Notice Copyright 2004-2009, Barracuda Networks www. barracuda. com v4. x-090623-06-1119 All rights reserved. Use of this product and this manual is subject to license. Information in this document is subject to change without notice. Trademarks Barracuda Spam & Virus Firewall is a trademark of Barracuda Networks. [. . . ] Complete this step for the Barracuda2 system as well. No processes should be running when you add a system to a cluster. From the ADVANCED > Clustering page on the Barracuda1 system, enter a Shared Secret password for the cluster, and click Save Changes. From the ADVANCED > Clustering page on the Barracuda2 system, do the following: 4a. Enter the same Shared Secret password, and click Save Changes. In the Clustered Systems section, enter the IP address of the Barracuda1 system and click Join Cluster. 3. 4. 5. On each Barracuda system, refresh the ADVANCED > Clustering page, and verify that: · Each system's IP address appears in the Clustered Systems list · The status of each server is green The following example shows two servers in a cluster with a green status. Figure 6. 1: Two Barracuda Spam & Virus Firewall systems in a cluster Make sure each clustered server's IP address appears in this list. Make sure the status of each server is green. Advanced Configuration 67 6. Distribute the incoming mail traffic to each Barracuda Spam & Virus Firewall using a Barracuda Load Balancer (preferred) or other load balancing device, or use multiple DNS MX records of equal priority. Each Barracuda Spam & Virus Firewall in a cluster must be on exactly the same firmware version. See the online help on the ADVANCED > Clustering page for instructions in updating the firmware on all systems in the cluster at the same time. 7. Centralized Policy Management With a Quarantine Host You can optionally designate one Barracuda Spam & Virus Firewall as the "host" of the cluster such that all administration of configuration settings and access to per-user quarantine for the cluster can only be accessed and set from that node. This option has two advantages: it provides for additional security by limiting access to administration of the cluster, and it protects the user interface from mail processing load since, with this configuration, you do not direct any email traffic to the host node. If you want to set up one Barracuda Spam & Virus Firewall as the host of the cluster, enter the host name of that device in the Quarantine Host field on the BASIC > Quarantine page and do not direct any email to that device. Redundancy of user quarantine data on the cluster Each user account has a primary and backup server in the cluster. Regardless of how many Barracuda Spam & Virus Firewalls there are in the cluster, there are always two appliances that have the same quarantine information (configuration and quarantine messages). Data Not Synchronized Across the Cluster Clustering not only makes managing multiple Barracuda Spam & Virus Firewalls more manageable, it also provides 100% redundant coverage of the propagated data. However, for practical reasons, some data is not propagated to the other clustered systems when a new system joins. Energize updates do not synchronize across systems in a cluster. The following Barracuda Spam & Virus Firewall configurations are considered unique and will not sync to match other Barracuda Spam & Virus Firewalls in a cluster: · IP Address, Subnet Mask, and Default Gateway (on the BASIC > IP Configuration page) · Primary DNS Server and Secondary DNS Server (on the BASIC > IP Configuration page) · Serial number (this will never change) · Hostname (on the BASIC > IP Configuration page) · Any advanced IP configuration (Barracuda Spam & Virus Firewall 600 and above, on the ADVANCED > Advanced Networking page) · Administrator password · Guest password · Time Zone (on the BASIC > Administration page) · Cluster Host Name (on the ADVANCED > Clustering page) · Cluster Shared Secret, though this must be the same for the cluster to work properly (on the ADVANCED > Clustering page) 68 Barracuda Spam & Virus Firewall Administrator's Guide · · · · · · · · · · · · Local Host Map (on the ADVANCED > Clustering page) SMTP Welcome Banner (on the ADVANCED > Email Protocol page) Web Interface HTTP Port (on the BASIC > Administration page) Web Interface HTTPS/SSL port (on the ADVANCED > Secure Administration page) Any other secure administration configuration, including saved certificates (on the ADVANCED > Secure Administration page) Quarantine Host (on the BASIC > Quarantine page) All SSL/TLS information, including saved certificates (on the ADVANCED > SMTP/TLS page) Whether to only display local messages in the message log (Only view local messages on the BASIC > Message Log > Preferences page) Whether the latest release notes have been read All customized branding (Barracuda Spam & Virus Firewall 600 and above, on the ADVANCED > Advanced Appearance page) The Explicit Accepted Users list, if enabled and used, on the ADVANCED > Explicit Users page. The Valid Recipients list on the DOMAINS > Manage Domain > USERS > Valid Recipients page. This is a per-domain setting. Advanced Configuration 69 Advanced Networking Port Forwarding If your organization has a single public IP address, when you install the Barracuda Spam & Virus Firewall between the Internet and your mail server, you can forward incoming SMTP traffic (port 25) from port 80 on the Barracuda to your mail server using the Port Forwarding feature from the ADVANCED > Advanced Networking page. Configuring the Network Interfaces With the Barracuda Spam & Virus Firewall model 600 and above, you can configure each of the two Ethernet (NICS) interfaces directly from the ADVANCED > Advanced Networking page to accept email on both interfaces or to route ingress email to one NIC and egress through the other NIC. Benefits of this feature include redundancy, filtering email for domains on separate networks and improving throughput. Up to 250 IP addresses can be configured per NIC. Static Routes You can specify a default gateway between the Barracuda Spam & Virus Firewall and a mail server on another subnet in your organization using the Static Routes feature on the ADVANCED > Advanced Networking page. This will guarantee that return traffic is routed back to the Barracuda Spam & Virus Firewall from the unassociated network. Loopback Adapter If you want to use this Barracuda Spam & Virus Firewall with a Barracuda Load Balancer in Direct Server Return mode, you must enable a non-ARPing loopback adapter. If you are using any other mode you do not need to make any changes to the Barracuda Spam & Virus Firewall configuration. Each Virtual IP address supported by the Real Server (the Barracuda Spam & Virus Firewall in this case) requires its own loopback adapter. [. . . ] The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. [. . . ]