This article applies to:
- Trustwave MailMarshal (SEG) 10.X
- Microsoft Exchange Server
Question:
- What steps are required to install MailMarshal (SEG) 10.X Array Manager on the same server as Microsoft Exchange?
- SEG upgrade could not import configuration
- SEG websites not running
Background:
MailMarshal (SEG) 10.X can be installed on the same server as Microsoft Exchange (assuming adequate resource and a relatively small organization).
The website settings and bindings required by the MailMarshal (SEG) 10.X Management Console conflict with modules and bindings used by Exchange Server.
To minimize downtime and conflicts, make the required changes before installing SEG.
If you have already performed an upgrade installation of SEG and websites did not start, see the section Post-Upgrade Steps below.
Procedure:
TLS Settings
Windows Server 2016 may reject certain TLS ciphers used by the .NET framework. This issue can result in failure to connect to the MailMarshal (SEG) 10.X Management Console, with browser error messages related to "HTTP2 inadequate transport security".
To resolve this issue, set TLS options on the server to current best practices. To simplify this process, you can use the free application IISCrypto from Nartac Software. See also Trustwave Knowledgebase article
Q19998.
- Note that TLS changes require a server restart.
Web Modules
Exchange websites (Exchange Management Console and OWA) use a number of 64 bit modules that are not supported by the 32 bit SEG websites. SEG websites will not start by default (including the Configuration Service and Management Console).
To resolve this issue, make the changes described in Trustwave Knowledgebase article
Q12671. Exact steps vary depending on the Exchange features installed.
- After these changes are made, the SEG SQM website can also be installed.
- Note that installation of an Exchange CU can reset these changes. In this case you would need to re-apply the changes.
- Changes may require IIS Reset.
Website ports
Exchange uses the default HTTPS port 443. To avoid conflict, configure the SEG Management Console on another port, or specify IP addresses or Server Name Indication (SNI) to be used by each site. MailMarshal (SEG) 10.0.1 and above installation checks for website port conflicts and prompts you.
Ensure that all sites are using appropriate certificates, particularly if you are making changes after both products are installed.
- Changes may require IIS Reset.
SMTP port
Exchange uses SMTP port 25 for email listening by default. You must set the SEG Receiver to use a different port, or change the port used by Exchange. Refer to the SEG User Guide and documentation for Exchange Receiver connectors. For general guidance also see Trustwave Knowledgebase article
Q11972.
- Changes will require service restarts.
Post-Upgrade Steps
If you upgraded SEG and you encountered a message that configuration could not be imported, you can import the configuration manually.
- Confirm that SEG websites are running.
- Use the SEG Configuration Service Admin Tool to confirm that a SEG user account was created by the install process.
- From a command prompt, navigate to the SEG install folder (by default C:\Program Files\Trustwave\Secure Email Gateway)
- To import the configuration that was automatically converted by upgrade, enter
mmexportcfg -i -u admin -p adminpwd -f temp\seg10convertedconfig.zip
- Substitute the username and password that you entered in the upgrade installer
- For details of mmexportcfg parameters see the User Guide
- Start SEG services.