Configuring IronPort to use TLS

Question

We have never used TLS before and havent got ant certs/keys C650
Is there a checklist of everything needed to set up TLS between our company and a external company that requires it?
I know there is information in the Advanced user guide but I need a dummy guide!

Answer 1

Yeah, you probably don't to require/prefer all inbound connections to have to go through a TLS check as this can hamper performance.
A common method is to create a new Sendergroup(SG) and Mail flow policy(MFP) that either prefers or requires TLS to be established before transfer of information on a "as needed basis".
For example, call the new sendergroup, "TLS_Required" and position it above the Whitelist SG. Assign this new "TLS_Required" SG to the new MFP called "Accepted_TLS" for example. Then, add the IP, hostname, or partial hostnames (ie. .bankofamerica.com) to the new SG.
This is one way of doing it. How have other companies that put a lot of importantance on TLS receiving and delivery done it? Anyone?
Also, remember that HAT Overview/MFP are for receiving. In other words, when other incoming hosts connect to your Ironport appliance.
"Mail Policies > Destination Controls", is for when your Ironport appliance delivers mail to hosts on the Internet. You probably don't want to make TLS Prefer/Require as the default. Likewise, you should create corresponding destination host entries for the domains that need the connections to be secure. However, if you're a banking institution and it's vital that all transactions between you and the Internet be made securely, then you may need to enable it on the Default.
Hope that helps.
Thanks folks.
Do companies normally set their public listners to preffered for default MFP? Is there a perceived performance hit in activating for all?
If we create MFP for thoses companies who require TLS I presume this just generates NDR?
Thanks John.