Migrating to a new installation

In some scenarios you might find yourself having to perform an IP address changing to your appliance. This operation could be dangerous and cause disservice if not done with proper care. In this How To is explained how to perform a risk-free appliance IP address migration. [fruitful_alert type="alert-info"]Note: If the destination VM is a Libraesva cloud one is required to contact support here.[/fruitful_alert]

Prerequisites

Before performing the appliance migration, please perform the below adjustments in order to avoid email loss or heavy disservices.

Setting up the PTR record

The PTR record is essential to perform the reverse DNS (rDNS) check on the IP address of the delivering mail server. You must to set the PTR record of the IP address the new appliance will have, pointing to the appliance hostname. Note: if your installation is a Libraesva Cloud appliance, the PTR record creation is completely managed by the Libraesva operation team, so you don't have to create any PTR record.

Updating the SPF record

The SPF record is a TXT DNS record that defines the hosts IP addresses that are allowed to send email on behalf of your domain. You need to update it with the new appliance IP address in order to avoid receiving mail servers rejecting the email coming from the new installation. The SPF record must be updated for every domains that sends emails through ESG. Note: if your installation is a Libraesva Cloud appliance and your domain has the include:spf.esvacloud.com directive in your SPF record, you don't have to update it.

Dealing with Microsoft 365

If one or more domain in your appliance Relay Configuration page are on a Microsoft 365 tenant, the first operation to perform is to add the new IP address to the existing connectors and rules. The Libraesva ESG Microsoft 365 setup involves a connector configuration and a rule creation on the Microsoft 365 tenant. The goal of the connector is to avoid the rate limiting on the delivery stage for incoming emails, while the rule disables Microsoft antispam scan to already scanned email coming from ESG. To edit your tenant settings you need to login to your Microsoft 365 Exchange admin center with your tenant admin credentials.

Connector

First of all you need to move on the Connectors configuration page as shown below. Edit the ESG incoming connector by selecting it and clicking on the Edit sent email identity as shown in the screenshot below. Type the new appliance IP address in the field and click on the [+] button and click on Save at the bottom right of the page.

Rules

When the connector is successfully updated with the new IP address, you can update the rule going to the Rules page. Select the rule having the "Do the following" parameter set to "Set the spam confidence level (SCL) to '-1'". Edit the rule by clicking on the "Edit rule settings" button. Switch to the Conditions tab and click on the pencil icon in the "Apply this rule if" section. Type the new IP address in the field and click on the Add blue button. Click on the Save button at the bottom right of the page to confirm the rule update.

Create the new appliance 

First of all you need to download the Libraesva ESG image from the Download page and import in your hypervisor. When the appliance has been deployed, you can follow the Initial Setup guide to complete the wizard. Note: cross check your running Libraesva ESG version is the same as the newly deployed version. In case of a mismatch, please upgrade it to the same version level.

Migrate the configuration

The new installation should have the same configurations and data of the previous one, so we need to migrate them to the new installation.

Create the backup

Reach the Backup page of your running appliance and create the backup as below. The backup must include the Configuration and the Reputation history as shown in the screenshot below. The Message history backup is not required for a successful migration and you can create and restore this backup later. When you are ready, click on the Backup green button to start the backup procedure. When the backup is completed, download it clicking on the green download button as shown in the screenshot below. Note: the backup extension must be .tar.gz, some browsers changes the extension, so please check it.

Restore the backup

When the backup has been created and downloaded, you need to upload to the new appliance by reaching the Backup page in the new appliance and clicking the Choose file button in the Upload Backup section.

Switch the flow

To avoid any email loss, you need to empty out the queue of appliance you need to migrate. To reach this goal, a little disservice will unfortunately be there.

Pausing incoming flow

Login as administrator the appliance you need to migrate (the one that are processing emails). Reach the Core Services page and click on the Pause yellow button in the Pause Incoming Email section.

Outgoing queue emptying

Reach the Advanced Configuration page and set the Maximal queue lifetime to "1s" (1 second), scroll down the page and click on the Save button. This setting lets the appliance to generate a bounce for each undeliverable email in the outgoing queue. You are ready to emptying out the outgoing queue. To perform this operation, please reach the Mail Queues page, move on the Outgoing Queue tab and click on the Retry all button every 10 seconds. By refreshing the page you should see the queue slowly emptying out. Keep clicking the Retry all button and refreshing the page every 10 seconds until no more email in the queue.

Switch the DNS record

Login to your DNS page and overwrite the old appliance IP address with the new one in the A record matching your appliance hostname.