Restrict Inbound Mail to Email Gateway Defense IP Range

The steps in this section enhance the security of the connection between Email Gateway Defense and Microsoft 365. It will only allow inbound email to come from the Barracuda Networks system.

1. Install Exchange Online module.
   • If you have already installed Exchange Online module, proceed to the next step.
   • To install Exchange Online module, open Windows PowerShell as an administrator and enter the following command: 
     Install-Module -Name ExchangeOnlineManagement
2. Connect to Exchange Online Powershell and log in with your Microsoft 365 administrator account using the following command:

   • Connect-ExchangeOnline

     For more information on connecting to Exchange Online Powershell, see the Microsoft article https://docs.microsoft.com/en-us/powershell/exchange/connect-to-exchange-online-powershell?view=exchange-ps.

     If you encounter issues running the PowerShell scripts, you can temporarily change the Windows PowerShell script execution policy . For more information, see the Microsoft article https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.3.

3. Find the correct IP range based on the region selected when setting up your Barracuda Networks instance. Refer to the Email Gateway Defense IP Ranges Used for Configuration for the IP ranges corresponding to your region. 

4. After you connect to Exchange Online PowerShell, run the appropriate PowerShell script based on your region: 

   PowerShell Script for the Australia Region

   New-InboundConnector -ConnectorType Partner -Name "Barracuda Inbound Connector" -RequireTls $true -SenderDomains * -SenderIPAddresses 3.24.133.128/25 -RestrictDomainstoIPAddresses $true      

   PowerShell Script for the Canada Region

   New-InboundConnector -ConnectorType Partner -Name "Barracuda Inbound Connector" -RequireTls $true -SenderDomains * -SenderIPAddresses 15.222.16.128/25 -RestrictDomainstoIPAddresses $true      

   PowerShell Script for the German Region

   New-InboundConnector -ConnectorType Partner -Name "Barracuda Inbound Connector" -RequireTls $true -SenderDomains * -SenderIPAddresses 35.157.190.224/27,18.185.115.192/26,18.184.203.224/27 -RestrictDomainstoIPAddresses $true

   PowerShell Script for the India Region

   New-InboundConnector -ConnectorType Partner -Name "Barracuda Inbound Connector" -RequireTls $true -SenderDomains * -SenderIPAddresses 13.200.136.128/25 -RestrictDomainstoIPAddresses $true      

   PowerShell Script for the UK Region

   New-InboundConnector -ConnectorType Partner -Name "Barracuda Inbound Connector" -RequireTls $true -SenderDomains * -SenderIPAddresses 35.176.92.96/27,18.133.136.128/26,18.133.136.96/27 -RestrictDomainstoIPAddresses $true      

   PowerShell Script for the US Region

   New-InboundConnector -ConnectorType Partner -Name "Barracuda Inbound Connector" -RequireTls $true -SenderDomains * -SenderIPAddresses 209.222.80.0/24,209.222.81.0/24,209.222.82.0/24,209.222.83.0/24,209.222.84.0/24,209.222.85.0/24,209.222.86.0/24,209.222.87.0/24 -RestrictDomainstoIPAddresses $true