TechNet
Export (0) Print
Expand All

Connection filtering procedures on Edge Transport servers

 

Topic Last Modified: 2016-04-19

Learn how to enable, disable, and configure connection filtering in Exchange 2016 and how to verify the connection filtering settings.

Connection filtering is an antispam feature that's provided by the Connection Filtering agent, which is available only on Edge Transport servers in Exchange Server 2016. Connection filtering enables the following features:

  • IP Block list

  • IP Block List providers

  • IP Allow list

  • IP Allow List providers

Each of these features can be enabled or disabled separately.

For more information about connection filtering, see Connection filtering on Edge Transport servers.

  • Estimated time to complete each procedure: 5 minutes.

  • You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "Antispam features" entry in the Antispam and antimalware permissions topic.

  • You can only use PowerShell to perform this procedure. To learn how to open the Exchange Management Shell in your on-premises Exchange organization, see Open the Exchange Management Shell.

  • For information about keyboard shortcuts that may apply to the procedures in this topic, see Keyboard shortcuts in the Exchange admin center.

tipTip:
Having problems? Ask for help in the Exchange forums. Visit the forums at: Exchange Server, Exchange Online, or Exchange Online Protection.

To completely enable or disable connection filtering, you enable or disable the Connection Filtering agent. The change takes effect after you restart the Microsoft Exchange Transport service. When you restart the Microsoft Exchange service on an Edge Transport server, mail flow on the server is temporarily interrupted.

To disable connection filtering, run the following command:

Disable-TransportAgent "Connection Filtering Agent"

To enable connection filtering, run the following command:

Enable-TransportAgent "Connection Filtering Agent"

To make the change take effect, restart the Microsoft Exchange Transport service by running the following command:

Restart-Service MSExchangeTransport

To verify that you successfully enabled or disabled connection filtering, run the following command to verify the Enabled property value.

Get-TransportAgent "Connection Filtering Agent" | Format-List Enabled

These procedures apply to the IP Block list that you manually configure. They don't apply to IP Block List providers.

Use the IPBlockListConfig cmdlets to view and configure how connection filtering uses the IP Block list. Use the IPBlockListEntry cmdlets to view and configure the IP addresses in the IP Block list.

To view the configuration of the IP Block list, run the following command:

Get-IPBlockListConfig | Format-List *Enabled,*Response

To disable the IP Block list, run the following command:

Set-IPBlockListConfig -Enabled $false

To enable the IP Block list, run the following command:

Set-IPBlockListConfig -Enabled $true

For more information, see Set-IPBlockListConfig.

To verify that you successfully enabled or disabled the IP Block list, run the following command to verify the Enabled property value.

Get-IPBlockListConfig | Format-List Enabled

To configure the IP Block list, use the following syntax:

Set-IPBlockListConfig [-ExternalMailEnabled <$true | $false>] [-InternalMailEnabled <$true | $false> -MachineEntryRejectionResponse "<Custom response text>"] [-StaticEntryRejectionResponse "<Custom response text>"]

This example configures the IP Block list with the following settings:

  • The IP Block list filters incoming connections from internal and external mail servers. By default, connections are filtered from external mail servers only (ExternalMailEnabled is set to $true, and InternalMailEnabled is set to $false). Non-authenticated connections and authenticated connections from external partners are considered external.

  • The custom response text for connections that were filtered by IP addresses that were automatically added to the IP Block list by the sender reputation feature of the Protocol Analysis agent is set to the value "Connection from IP address {0} was rejected by sender reputation."

  • The custom response text for connections that were filtered by IP addresses that were manually added to the IP Block list is set to the value "Connection from IP address {0} was rejected by connection filtering."

Set-IPBlockListConfig -InternalMailEnabled $true -MachineEntryRejectionResponse "Connection from IP address {0} was rejected by sender reputation." -StaticEntryRejectionResponse "Connection from IP address {0} was rejected by connection filtering."

For more information, see Set-IPBlockListConfig.

To verify that you successfully configured the IP Block list, run the following command to verify the property values.

Get-IPBlockListConfig | Format-List *MailEnabled,*Response

To view all IP Block list entries, run the following command:

Get-IPBlockListEntry

Note that each IP Block list entry is identified by an integer value. The identity integer is assigned in ascending order when you add entries to the IP Block list and the IP Allow list.

To view a specific IP Block list entry, use the following syntax:

Get-IPBlockListEntry <-Identity IdentityInteger | -IPAddress IPAddress>

For example, to view the IP Block list entry that contains the IP address 192.168.1.13, run the following command:

Get-IPBlockListEntry -IPAddress 192.168.1.13

For more information, see Get-IPBlockListEntry.

noteNote:
When you use the IPAddress parameter, the resulting IP Block list entry can be an individual IP address, an IP address range, or a Classless InterDomain Routing (CIDR) IP. To use the Identity parameter, you specify the integer value that's assigned to the IP Block list entry.

To add IP Block list entries, use the following syntax:

Add-IPBlockListEntry <-IPAddress IPAddress | -IPRange IP range or CIDR IP> [-ExpirationTime <DateTime>] [-Comment "<Descriptive Comment>"]

This example adds the IP Block list entry for the IP address range 192.168.1.10 through 192.168.1.15 and configures the IP Block list entry to expire on July 4, 2016 at 15:00.

Add-IPBlockListEntry -IPRange 192.168.1.10-192.168.1.15 -ExpirationTime "7/4/2016 15:00"

For more information, see Add-IPBlockListEntry.

To verify that you successfully added an IP Block list entry, run the following command and verify that the new IP Block list entry is displayed.

Get-IPBlockListEntry

To remove IP Block list entries, use the following syntax:

Remove-IPBlockListEntry <IdentityInteger>

This example removes the IP Block list entry that has the Identity value 3.

Remove-IPBlockListEntry 3

This example removes the IP Block list entry that contains the IP address 192.168.1.12 without using the Identity integer value. Note that the IP Block list entry can be an individual IP address or an IP address range.

Get-IPBlockListEntry -IPAddress 192.168.1.12 | Remove-IPBlockListEntry

For more information, see Remove-IPBlockListEntry.

To verify that you successfully removed an IP Block list entry, run the following command and verify that the IP Block list entry you removed is gone.

Get-IPBlockListEntry

These procedures apply to IP Block List providers. They don't apply to the IP Block list.

Use the IPBlockListProvidersConfig cmdlets to view and configure how connection filtering uses all IP Block List providers. Use the IPBlockListProvider cmdlets to view, configure, and test IP Block List providers.

To view how connection filtering uses all IP Block List providers, run the following command:

Get-IPBlockListProvidersConfig | Format-List *Enabled,Bypassed*

For more information, see Get-IPBlockListProvidersConfig.

To disable all IP Block List providers, run the following command:

Set-IPBlockListProvidersConfig -Enabled $false

To enable all IP Block List providers, run the following command:

Set-IPBlockListProvidersConfig -Enabled $true

For more information, see Set-IPBlockListProvidersConfig.

To verify that you enabled or disabled all IP Block List providers, run the following command to verify the value of the Enabled property:

Get-IPBlockListProvidersConfig | Format-List Enabled

To configure how connection filtering uses all IP Block List providers, use the following syntax:

Set-IPBlockListProvidersConfig [-BypassedRecipients <recipient1,recipient2...>] [-ExternalMailEnabled <$true | $false>] [-InternalMailEnabled <$true | $false>]

This example configures all IP Block List providers with the following settings:

  • IP Block List providers filter incoming connections from internal and external mail servers. By default, connections are filtered from external mail servers only (ExternalMailEnabled is set to $true, and InternalMailEnabled is set to $false). Non-authenticated connections and authenticated connections from external partners are considered external.

  • Messages sent to the internal recipients chris@fabrikam.com and michelle@fabrikam.com are excluded from filtering by IP Block List providers. Note that if you want to add recipients to the list without affecting existing recipients, use the syntax, @{Add="<recipient1>","<recipient2>"...}.

Set-IPBlockListProvidersConfig -BypassedRecipients chris@fabrikam.com,michelle@fabrikam.com -InternalMailEnabled $true

For more information, see Set-IPBlockListProvidersConfig.

To verify that you successfully configured all IP Block List providers, run the following command to verify the property values:

Get-IPBlockListProvidersConfig | Format-List *MailEnabled,Bypassed*

To view the summary list of all the IP Block List providers, run the following command:

Get-IPBlockListProvider

To view the details of a specific provider, use the following syntax:

Get-IPBlockListProvider <IPBlockListProviderIdentity>

This example show the details of the provider named Contoso IP Block List Provider.

Get-IPBlockListProvider "Contoso IP Block List Provider" | Format-List Name,Enabled,Priority,LookupDomain,*Match,*Response

For more information, see Get-IPBlockListProvider.

To add an IP Block List provider, use the following syntax:

Add-IPBlockListProvider -Name "<Descriptive Name>" -LookupDomain <FQDN> [-Priority <Integer>] [-Enabled <$true | $false>] [-AnyMatch <$true | $false>] [-BitmaskMatch <IPAddress>] [-IPAddressesMatch <IPAddressStatusCode1,IPAddressStatusCode2...>] [-RejectionResponse "<Custom Text>"]

This example creates an IP Block List provider named "Contoso IP Block List Provider" with the following options:

  • FQDN to use the provider   rbl.contoso.com

  • Bitmask code to use from the provider   127.0.0.1

Add-IPBlockListProvider -Name "Contoso IP Block List Provider" -LookupDomain rbl.contoso.com -BitmaskMatch 127.0.0.1
noteNote:
When you add a new IP Block List provider, it's enabled by default (the value of Enabled is $true), and the priority value is incremented (the first entry has the Priority value 1).

For more information, see Add-IPBlockListProvider.

To verify that you successfully added an IP Block List provider, run the following command and verify that the new IP Block List provider is displayed.

Get-IPBlockListProvider

To enable or disable a specific IP Block List provider, use the following syntax:

Set-IPBlockListProvider <IPBlockListProviderIdentity> -Enabled <$true | $false>

This example disables the provider named Contoso IP Block List Provider.

Set-IPBlockListProvider "Contoso IP Block List Provider" -Enabled $false

This example enables the provider named Contoso IP Block List Provider.

Set-IPBlockListProvider "Contoso IP Block List Provider" -Enabled $true

For more information, see Set-IPBlockListProvider.

To verify that you successfully enabled or disabled an IP Block List provider, run the following command to verify the value of the Enabled property:

Get-IPBlockListProvider  | Format-Table -Auto Name,LookupDomain,Priority,Enabled

The configuration options that are available on the Set-IPBlockListProvider cmdlet are identical to those on the Add-IPBlockListProvider cmdlet.

To configure an existing IP Block List provider, use the following syntax:

Set-IPBlockListProvider <IPBlockListProviderIdentity> -Name "<Descriptive Name>" -LookupDomain <FQDN> [-Priority <Integer>] [-AnyMatch <$true | $false>] [-BitmaskMatch <IPAddress>] [-IPAddressesMatch <IPAddressStatusCode1,IPAddressStatusCode2...>] [-RejectionResponse "<Custom Text>"]

For example, to add the IP address status code 127.0.0.1 to the list of existing status codes for the provider named Contoso IP Block List Provider, run the following command:

Set-IPBlockListProvider "Contoso IP Block List Provider" -IPAddressesMatch @{Add="127.0.0.1"}

For more information, see Set-IPBlockListProvider.

To verify that you successfully configured an IP Block List provider, run the following command to verify the property values. Be sure to replace <IPBlockListProviderIdentity> with the name of the IP Block List provider.

Get-IPBlockListProvider <IPBlockListProviderIdentity> | Format-List

To test an IP Block List provider, use the following syntax:

Test-IPBlockListProvider <IPBlockListProviderIdentity> -IPAddress <IPAddressToTest>

This example tests the provider named Contoso IP Block List Provider by looking up the IP address 192.168.1.1.

Test-IPBlockListProvider "Contoso IP Block List Provider" -IPAddress 192.168.1.1

For more information, see Test-IPBlockListProvider.

To remove an IP Block List provider, use the following syntax:

Remove-IPBlockListProvider <IPBlockListProviderIdentity>

This example removes the IP Block List provider named Contoso IP Block List Provider.

Remove-IPBlockListProvider "Contoso IP Block list Provider"

For more information, see Remove-IPBlockListProvider.

To verify that you successfully removed an IP Block List provider, run the following command and verify that the IP Block List provider you removed is gone.

Get-IPBlockListProvider

These procedures apply to the IP Allow list that you manually configure. They don't apply to IP Allow List providers.

Use the IPAllowListConfig cmdlets to view and configure how connection filtering uses the IP Allow list. Use the IPAllowListEntry cmdlets to view and configure the IP addresses in the IP Allow list.

To view the configuration of the IP Allow list, run the following command.

Get-IPAllowListConfig | Format-List *Enabled

For more information, see Get-IPAllowListConfig.

To disable the IP Allow list, run the following command:

Set-IPAllowListConfig -Enabled $false

To enable the IP Allow list, run the following command:

Set-IPAllowListConfig -Enabled $true

To verify that you successfully enabled or disabled the IP Allow list, run the following command to verify the value of the Enabled property:

Get-IPAllowListConfig | Format-List Enabled

To configure the IP Allow list, use the following syntax:

Set-IPAllowListConfig [-ExternalMailEnabled <$true | $false>] [-InternalMailEnabled <$true | $false>

This example configures the IP Allow list to filter incoming connections from internal and external mail servers. By default, connections are filtered from external mail servers only (ExternalMailEnabled is set to $true, and InternalMailEnabled is set to $false). Non-authenticated connections and authenticated connections from external partners are considered external.

Set-IPAllowListConfig -InternalMailEnabled $true

For more information, see Set-IPAllowListConfig.

To verify that you successfully configured the IP Allow list, run the following command to verify the property values:

Get-IPAllowListConfig | Format-List *MailEnabled

To view all IP Allow list entries, run the following command:

Get-IPAllowListEntry

Note that each IP Allow list entry is identified by an integer value. The identity integer is assigned in ascending order when you add entries to the IP Block list and the IP Allow list.

To view a specific IP Allow list entry, use the following syntax:

Get-IPAllowListEntry <-Identity IdentityInteger | -IPAddress IPAddress>

For example, to view the IP Allow list entry that contains the IP address 192.168.1.13, run the following command:

Get-IPAllowListEntry -IPAddress 192.168.1.13

For more information, see Get-IPAllowListEntry.

noteNote:
When you use the IPAddress parameter, the resulting IP Allow list entry can be an individual IP address, an IP address range, or a Classless InterDomain Routing (CIDR) IP. To use the Identity parameter, you specify the integer value that's assigned to the IP Allow list entry.

To add IP Allow list entries, use the following syntax:

Add-IPAllowListEntry <-IPAddress IPAddress | -IPRange IP range or CIDR IP> [-ExpirationTime <DateTime>] [-Comment "<Descriptive Comment>"]

This example adds the IP Allow list entry for the IP address range 192.168.1.10 through 192.168.1.15 and configures the IP Allow list entry to expire on July 4, 2016 at 15:00.

Add-IPAllowListEntry -IPRange 192.168.1.10-192.168.1.15 -ExpirationTime "7/4/2016 15:00"

For more information, see Add-IPAllowListEntry.

To verify that you successfully added an IP Allow list entry, run the following command and verify that the new IP Allow list entry is displayed.

Get-IPAllowListEntry

To remove IP Allow list entries, use the following syntax:

Remove-IPAllowListEntry <IdentityInteger>

This example removes the IP Allow list entry that has the Identity value 3.

Remove-IPAllowListEntry 3

This example removes the IP Allow list entry that contains the IP address 192.168.1.12 without using the Identity integer value. Note that the IP Allow list entry can be an individual IP address or an IP address range.

Get-IPAllowListEntry -IPAddress 192.168.1.12 | Remove-IPAllowListEntry

For more information, see Remove-IPAllowListEntry.

To verify that you successfully removed an IP Allow list entry, run the following command and verify that the IP Allow list entry you removed is gone.

Get-IPAllowListEntry

These procedures apply to IP Allow List providers. They don't apply to the IP Allow list.

Use the IPAllowListProvidersConfig cmdlets to view and configure how connection filtering uses all IP Allow List providers. Use the IPAllowListProvider cmdlets to view, configure, and test IP Allow List providers.

To view how connection filtering uses all IP Allow List providers, run the following command:

Get-IPAllowListProvidersConfig | Format-List *Enabled

For more information, see Get-IPAllowListProvidersConfig.

To disable all IP Allow List providers, run the following command:

Set-IPAllowListProvidersConfig -Enabled $false

To enable all IP Allow List providers, run the following command:

Set-IPAllowListProvidersConfig -Enabled $true

For more information, see Set-IPAllowListProvidersConfig.

To verify that you enabled or disabled all IP Allow List providers, run the following command to verify the Enabled property value:

Get-IPAllowListProvidersConfig | Format-List Enabled

To configure how connection filtering uses all IP Allow List providers, use the following syntax:

Set-IPAllowListProvidersConfig [-ExternalMailEnabled <$true | $false>] [-InternalMailEnabled <$true | $false>]

This example configures all IP Allow List providers to filter incoming connections from internal and external mail servers. By default, connections are filtered from external mail servers only (ExternalMailEnabled is set to $true, and InternalMailEnabled is set to $false). Non-authenticated connections and authenticated connections from external partners are considered external.

Set-IPAllowListProvidersConfig -InternalMailEnabled $true

For more information, see Set-IPBlockListProvidersConfig.

To verify that you successfully configured all IP Allow List providers, run the following command to verify the property values:

Get-IPAllowListProvidersConfig | Format-List *MailEnabled

To view the summary list of all the IP Allow List providers, run the following command.

Get-IPAllowListProvider

To view the details of a specific provider, use the following syntax:

Get-IPAllowListProvider <IPAllowListProviderIdentity>

This example show the details of the provider named Contoso IP Allow List Provider.

Get-IPAllowListProvider "Contoso IP Allow List Provider" | Format-List Name,Enabled,Priority,LookupDomain,*Match

For more information, see Get-IPAllowListProvider.

To add an IP Allow List provider, use the following syntax:

Add-IPAllowListProvider -Name "<Descriptive Name>" -LookupDomain <FQDN> [-Priority <Integer>] [-Enabled <$true | $false>] [-AnyMatch <$true | $false>] [-BitmaskMatch <IPAddress>] [-IPAddressesMatch <IPAddressStatusCode1,IPAddressStatusCode2...>]

This example creates an IP Allow List provider named "Contoso IP Allow List Provider" with the following options:

  • FQDN to use the provider   allow.contoso.com

  • Bitmask code to use from the provider   127.0.0.1

Add-IPAllowListProvider -Name "Contoso IP Allow List Provider" -LookupDomain allow.contoso.com -BitmaskMatch 127.0.0.1
noteNote:
When you add a new IP Allow List provider, it's enabled by default (the value of Enabled is $true), and the priority value is incremented (the first entry has the Priority value 1).

For more information, see Add-IPBlockListProvider.

To verify that you successfully added an IP Allow List provider, run the following command and verify that the new IP Allow List provider is displayed.

Get-IPAllowListProvider

To enable or disable a specific IP Allow List provider, use the following syntax:

Set-IPAllowListProvider <IPAllowListProviderIdentity> -Enabled <$true | $false>

This example disables the provider named Contoso IP Allow List Provider.

Set-IPAllowListProvider "Contoso IP Allow List Provider" -Enabled $false

This example enables the provider named Contoso IP Allow List Provider.

Set-IPAllowListProvider "Contoso IP Allow List Provider" -Enabled $true

For more information, see Set-IPBlockListProvider.

To verify that you successfully enabled or disabled an IP Allow List provider, run the following command to verify the Enabled property value:

Get-IPAllowListProvider | Format-Table -Auto Name,LookupDomain,Priority,Enabled

The configuration options that are available on the Set-IPAllowListProvider cmdlet are identical to those on the Add-IPAllowListProvider cmdlet.

To configure an existing IP Allow List provider, use the following syntax:

Set-IPAllowListProvider <IPAllowListProviderIdentity> -Name "<Descriptive Name>" -LookupDomain <FQDN> [-Priority <Integer>] [-AnyMatch <$true | $false>] [-BitmaskMatch <IPAddress>] [-IPAddressesMatch <IPAddressStatusCode1,IPAddressStatusCode2...>]

For example, to add the IP address status code 127.0.0.1 to the list of existing status codes for the provider named Contoso IP Allow List Provider, run the following command:

Set-IPAllowListProvider "Contoso IP Allow List Provider" -IPAddressesMatch @{Add="127.0.0.1"}

For more information, see Set-IPBlockListProvider.

To verify that you successfully configured an IP Allow List provider, run the following command. Be sure to replace <IPAllowListProviderIdentity> with the name of the IP Allow List provider.

Get-IPAllowListProvider <IPAllowListProviderIdentity> | Format-List

To test an IP Allow List provider, use the following syntax:

Test-IPAllowListProvider <IPAllowListProviderIdentity> -IPAddress <IPAddressToTest>

This example tests the provider named Contoso IP Allow List Provider by looking up the IP address 192.168.1.1.

Test-IPAllowListProvider "Contoso IP Allow List Provider" -IPAddress 192.168.1.1

For more information, see Test-IPAllowListProvider.

To remove an IP Allow List provider, use the following syntax:

Remove-IPAllowListProvider <IPAllowListProviderIdentity>

This example removes the IP Allow List provider named Contoso IP Allow List Provider.

Remove-IPAllowListProvider "Contoso IP Allow List Provider"

For more information, see Remove-IPAllowListProvider.

To verify that you successfully removed an IP Allow List provider, run the following command and verify that the IP Allow List provider you removed is gone.

Get-IPAllowListProvider
 
Show:
© 2016 Microsoft