Google Workspace Configuration – LibraCyber - Help Center

This article is a guideline to configure Google Workspace with LibraCyber ESG.

Inbound Configuration

WARNING: If inside of your Google Workspace tenant you created rules for internal forwarding, please follow this guide first

Google Inbound Gateway

Log into the Google Workspace Domain Management Portal.
Navigate to Apps > Google Workspace> Gmail > Spam, Phishing and Malware
Find the Inbound gateway and enter the public LibraCyber ESG Hostname or IP address

Note: Make sure to flag the checkbox “Only let users receive email from the email gateways listed above”. All other emails will be rejected.

Google Email Allowlist

Find the Email Allowlist Table and enter the public LibraCyber ESG IP address or addresses in case of a cluster

With this configuration, Google will also route internal mail (from your domain to your domain) through ESG. This will provide visibility into internal email traffic. In order to NOT perform spam checks on the internal email you can add a whitelist for an email from your domain (security checks will still be performed). If you want internal email to remain within Google and not be routed through ESG read the paragraph “How to bypass ESG for internal email” below.

Add a relay on LibraCyber Email Security Gateway

WARNING: Google Workspace Mail Server record changed from the OLD "aspmx.l.google.com" to the NEW "smtp.google.com". IF YOUR EMAIL IS WORKING, YOU DON'T NEED TO CHANGE YOUR CURRENT CONFIGURATION. More information here: https://support.google.com/a/answer/1600425

To add a domain and forward clean emails to Google Apps, navigate to Admin Area in ESG Mail Transport >Relay Configuration and select Domain Relay > New. Fill in the fields as follows:

Domain: specify your domain, the one you have with Google Apps
Mail Server: smtp.google.com
Port: 25
Use MX: NO.
Recipient Verification: Dynamic Verification or Valid Recipient List (or “Disabled” if you enabled a “catch-all address”)
Dynamic Verification Server Address: smtp.google.com
Dynamic Verification Port: 25
Domain Anti-spoofing set it to SPF.

Finally, remember to add an MX record with the highest priority (less weight) to your ESG appliance to route mail flow through LibraCyber ESG.

Outbound Configuration (optional)

This is an optional configuration.

Trust Google Workspace in LibraCyber ESG

To trust Google Workspace and enable outbound mail relay, navigate to ESG Admin Area Mail Transport >Relay Configuration and select Trusted Networks. Click on the Enable button besides Trust Google Suite.

Add a new Host Route in Google Workspace

Log into the Google Google Workspace Domain Management Portal.
Navigate to Apps > Google Workspace > Gmail > Hosts
Click on ADD ROUTE
Give it a name, like ESG for example
Choose Single Host if you have a single ESG instance or Multiple hosts if you have a cluster
Enter the ip addresse(s) of your ESG appliance(s) and, in case of multiple hosts, the weight.

This is an example configuration for a single ESG:

This is an example configuration for an ESG cluster:

By unchecking “Require mail to be transmitted via a secure(TLS) connection” you are allowing self-signed TLS certificates on ESG. If you wish to check this checkbox make sure that you have a valid non-self-signed certificate in use for SMTP on your ESG appliance(s). You have just created a host which is not yet in use. In the following step, you will use it for an outbound rule.

(Optional) Do not route notification of the Shared Document for External recipients through ESG

If you share documents with External recipients you need to add an additional Routing Rule to bypass ESG.

Log into the Google Workspace Domain Management Portal.
Navigate to Apps > Google Workspace > Gmail > Routing
Click on ADD ROUTE
Give it a name, like Route google drive notification normally for example
Set “Messages to affect” to Outbound
Set the flag “Change route” and select Normal Routing.
Click Show more options and select both Users and Groups
Under “Envelope filter” select “Only affect specific envelope senders
From the dropdown select “Single email address”
Enter the following email address drive-shares-dm-noreply@google.com used by Google Drive notifications
Click SAVE

Note: The Routing rule for bypass ESG for Google Drive notification must be configured before the rule for forward all the outbound flow through LibraCyber ESG

Add a new Routing Rule for Outbound flow in Google Workspace in Google Workspace

Log into the Google Workspace Domain Management Portal.
Navigate to Apps > Google Workspace > Gmail > Routing
Click on ADD ROUTE
Give it a name, like Outbound route for example
Set “Messages to affect” to “Outbound”
Set the flag “Change route” and choose the host you created at the previous step (ESG).
Click SAVE

This is what the final configuration looks like:

Click on SAVE at the bottom of the page and your outbound email traffic will route through your ESG.

How to bypass ESG for internal email (recommended)

By default, Google routes internal email (from your domain to your domain) to the inbound gateway (ESG). If you prefer to disable spam check for internal traffic, then it's recommended to not route the traffic via ESG. This is will greatly reduce the pressure on the appliance (e.g. queuing time and storage size). Security checks will still be performed on internal email. Should you want internal email to remain within Google and not be routed to ESG you must perform the configurations below.

Configuration to bypass ESG for internal email (step 1 of 3)

Log into the Google Workspace Domain Management Portal.
Navigate to Apps > Google Workspace > Gmail > Hosts
Click on ADD ROUTE
Give it a name, like GOOGLE for example
Choose Single Host
Enter smtp.google.com
Set port to 25
Click SAVE

This is what the configuration looks like:

Configuration to bypass ESG for internal email (step 2 of 3)

Log into the Google Workspace Domain Management Portal.
Navigate to Apps > Google Workspace > Gmail > Spam, Phishing and Malware
Find the Inbound gateway and click EDIT
Disable “Reject all mail, not from gateway IPs”

An alternative to disabling the “Reject all mail, not from gateway IPs” is to add to the Inbound Gateway IPs all the google IP subnets, which can be retrieved from Google's txt record spf.google.com.

Configuration to bypass ESG for internal email (step 3 of 3)

Log into the Google Workspace Domain Management Portal.
Navigate to Apps > Google Workspace > Gmail > Routing
Add a new route with the name “Internal”
Under “Messages to affect” select “Internal – sending”
Under “Envelope filter” select “Only affect specific envelope recipients“
From the dropdown select “Pattern match”
Enter the following pattern replacing yourdomain.com with your domain: .*\@yourdomain\.com
NOTE: this is a regular expression so it is important to keep the backslash.
Under “Route” check “Change route” and select the route “google” from the dropdown.
Click on “show options” at the end of the form and check both “users” and “groups”
Click on ADD SETTING
Click on SAVE