Step 3 - Configuring Exchange

In Exchange 2016 and 2019, there is no Protection > Connection filter section, so you need to perform the following steps:

1. Connect with administrator credentials to the Exchange Server via a remote desktop connection.

2. Open the Exchange Management Shell.

3. Run the following command:

   & $env:ExchangeInstallPath\Scripts\Install-AntiSpamAgents.ps1

4. Restart the Microsoft Exchange Transport service - using this command:

   Restart-Service MSExchangeTransport

5. Specify the internal SMTP servers, using one of the following commands: [See the drop-down below for details on how to determine your environment]

   What is the environment of your organization In FortiMail Workspace Security, go to Settings > Account. The Environment of your organization will appear under General > Info: US, EU, or AUS.

   Multi-region is not enabled
   US environments	Set-TransportConfig -InternalSMTPServers @{Add="3.81.182.154","3.93.155.149","3.95.118.12","3.95.142.181","54.227.64.76"}
   EU environments	Set-TransportConfig -InternalSMTPServers @{Add="99.81.216.78","34.249.190.60","108.128.137.108","99.80.189.20"}
   AUS environments	Set-TransportConfig -InternalSMTPServers @{Add="13.236.255.231","54.66.125.250"}

   Multi-region is enabled
   US environments	Set-TransportConfig -InternalSMTPServers @{Add="3.81.182.154","3.93.155.149","3.95.118.12","3.95.142.181","54.227.64.76","52.12.169.124"}
   EU environments	Set-TransportConfig -InternalSMTPServers @{Add="99.81.216.78","34.249.190.60","108.128.137.108","99.80.189.20","52.12.169.124"}
   AUS environments	Set-TransportConfig -InternalSMTPServers @{Add="13.236.255.231","54.66.125.250","52.12.169.124"}

   Note: If you encounter SPF issues, add your local Exchange IPs into the relevant InternalSMTPServers command above.

6. To verify the IPs were registered, run this command:

   Get-TransportConfig | Format-List InternalSMTPServers

 

1. Depending on the environment of your organization, add the following IP addresses to the list of allowed IP addresses in your environment: [Open the drop-down below for details on your environment.]

   What is the environment of your organization In FortiMail Workspace Security, go to Settings > Account. The Environment of your organization will appear under General > Info: US, EU, or AUS.

   For US environments	For EU environments	For AUS environments
   54.227.64.76 3.81.182.154 3.93.155.149 3.95.118.12 3.95.142.181 52.12.169.124 [required only if Muti-region is enabled]	99.81.216.78 34.249.190.60 108.128.137.108 99.80.189.20 52.12.169.124 [required only if Muti-region is enabled]	13.236.255.231 54.66.125.250 52.12.169.124 [required only if Muti-region is enabled]

1. In Exchange Admin, select Mail flow > Rules > "Create a new rule…"

2. Enter a Name for the new rule: Perception Point Spam Rule

3. Scroll down and click "More options…"

   

4. Select "Apply this rule if…" > "A message header…" > "Matches these text patterns"

5. Select "Enter text" and then specify the header name: X-PERCEPTION-POINT-SPAM

6. Select "Enter text patterns" and then specify the following words or phrases: FAIL - and then click "+"

7. Select "Do the following…" > "Modify the Message Properties"

8. Set the Spam Confidence Level to "6"

   Note: Make sure that the default junk SCL threshold is set to 4 (the default). To check the junk SCL threshold setting, run the following command: Get-OrganizationConfig | Format-List SCLJunkThreshold

   Spam will be sent to the user’s junk folder.

1. If you have a firewall, make sure that the Perception Point IPs [shown below] are allow-listed in your firewall. The set of IPs varies depending on the environment in which your organization is located. [Open the drop-down below for details on your environment.]

   What is the environment of your organization

   1. In FortiMail Workspace Security, go to Settings > Account.

   2. The Environment of your organization will appear under General > Info: US, EU, or AUS.

      

   For US environments	For EU environments	For AUS environments
   54.227.64.76 3.81.182.154 3.93.155.149 3.95.118.12 3.95.142.181 52.12.169.124 [required only if Muti-region is enabled]	99.81.216.78 34.249.190.60 108.128.137.108 99.80.189.20 52.12.169.124 [required only if Muti-region is enabled]	13.236.255.231 54.66.125.250 52.12.169.124 [required only if Muti-region is enabled]

2. On your network provider, change the MX record as follows:

   What is the environment of your organization In FortiMail Workspace Security, go to Settings > Account. The Environment of your organization will appear under General > Info: US, EU, or AUS.

   	Multi-region enabled	Multi-region not enabled
   For US environments	us.mx-pp.com	inbound-smtp.us-east-1.amazonaws.com
   For EU environments	eu.mx-pp.com	inbound-smtp.eu-west-1.amazonaws.com
   For AUS environments	australia.mx-pp.com	inbound-smtp.eu-west-1.amazonaws.com

1. In FortiMail Workspace Security, go to the Settings > Protected Email Assets page.

2. Under Inline Domains, locate the domain that you want to edit.

3. Click the blue arrow on the left of the domain name to display details of the domain.

4. Locate TLS configuration and then click Edit on the right.

5. In the Configure TLS Encryption dialog box, make the required changes.

   

   1. Use TLS encryption: When enabled, FortiMail Workspace Security will use TLS encryption when sending emails to this domain. By default, TLS version 1.2 is used.

      Note: Before you disable TLS encryption, it is recommended that you try "Allow legacy TLS versions" [see below] - unless you’re sure that the receiving server doesn't support TLS at all.

   2. Allow legacy TLS versions: When enabled, FortiMail Workspace Security will be able to use a TLS version earlier than 1.2, if that is what is required by the domain server that receives the emails from FortiMail Workspace Security.

6. Click Confirm.