How do I test MailMarshal in parallel with my existing mail relay and how do I run it in 'monitoring-only' mode?

This article applies to:

• Trustwave MailMarshal (SEG)

Question:

How do I test MailMarshal in parallel with my existing mail relay and how do I run it in 'monitoring-only' mode?

Procedure:

Sometimes there is a need to install MailMarshal in 'monitoring-only' mode for testing purposes, to cause minimal impact on existing mail flow.

There is no easy way to split SMTP traffic while preserving all the information used by spam filters. Trustwave cannot recommend any way of running MailMarshal in parallel with an existing mail relay or spam filter.

Our recommended solution is to place MailMarshal behind your firewall, in front of your current mail relay or mail server, and then to configure MailMarshal to only monitor (and not block) mail traffic. In this monitor-only mode, MailMarshal will COPY messages that are deemed spam, infected, inappropriate, offensive etc. into quarantine. Notice the action is only COPY - MailMarshal does not block messages in this mode. Rather all traffic is allowed through, and you can view the email that MailMarshal would have stopped if using normal blocking mode.

For further advice on setting up a monitoring only installation, contact your Trustwave Sales Engineer.

This article was previously published as:

NETIQKB38521