How to Journal to the Cloud Archiving Service from G Suite

Step 1. Activate the Service

1. Log into https://login.barracudanetworks.com/ using your Barracuda Cloud Control account credentials
2. Navigate to Home > Admin > Essentials.
3. Click Enter Linking Code and Serial Number to enter this information and activate your subscription.
   

Step 2. Add Users to Your Barracuda Cloud Control Account

Add users through LDAP authentication and associate a role and whose mail can be viewed with an LDAP user or group, or manually configure and assign roles to local accounts in the web interface.

Understanding Roles

• User – Able only to view messages accessible to the account, either because the username for the account is also that of the sender or recipient of a message, or because it has been given explicit access to view an email address via Alias Linking.
• Auditor – Able to create and activate policies, and view, search, and export any messages to/from the domains to which they have access. Additionally, Auditors can save and name an Advanced search for re-execution at a later time from the Saved Searches tab. To create a Domain Auditor (an auditor with access to only a subset of the domains on your Barracuda Cloud Archiving Service), set the role to Auditor and specify at least one domain. If no domains are specified, then all messages in the entire Barracuda Cloud Archiving Service are accessible. No auditor account has access to any system or network configuration information on the Barracuda Cloud Archiving Service.
• Admin – Able to view all items from any user, not just those listed for the account. Also able to create and activate policies, and can make other system or network changes.

Active Directory Configuration

Add a New LDAP or Azure Active Directory

1. Log into https://login.barracudanetworks.com/ as the account administrator, and go to Home >  Admin > Directories.

2. Click the Add Directory button.
   

3. Select one of the following sections to add a new LDAP or Azure active directory:

   Click here to add a new LDAP or Azure active directory...

   Add a New LDAP Active Directory

   1. Select LDAP Active Directory.
   2. On the INFO tab, specify a new Directory Name.

   3. Activate the Authentication option to have users authenticate using their LDAP credentials. If you disable this option, users authenticate with Barracuda Cloud Control.

      Barracuda strongly recommends creating an additional administrator account using an independent domain that does not use Active Directory (AD) authentication. This allows you access to your Barracuda product account if your AD server goes down or fails.

      

   4. Click SAVE AND CONTINUE.
   5. On the HOST tab, specify the following for the LDAP host:
      • LDAP Host IP address 
      • LDAP Host Port – Use Port 389 for LDAP and LDAPTLS or Port 636 for LDAPS.
      • Base Domain Name (DN) – Any user or group that exists with the search base that will sync to Barracuda Networks. For example, DC=domain,DC=com.
      • Bind DN – Enter the bind domain name for a service account with read permissions to the active directory.
      • Password – Password associated with the service account.
      • Connection Security – Select SSL, TLS, or None. For more information, see New Requirements for LDAP Authentication.
   6. (Optional) To add additional servers, click Add LDAP Host.
   7. If your LDAP server uses a self-signed certificate, toggle on the Allow Self-Signed Certificate setting.
   8. Click TEST CONNECTION to check connectivity to the host. If the connection fails, verify your settings are correct and that you have allowed the Barracuda Networks IP in your firewall. Contact Barracuda Technical Support for additional troubleshooting.
   9. If the connection succeeds, it displays as Connected. Click SAVE AND CONTINUE.
      
   10. On the DOMAINS tab, add the domains associated with your users.
   11. For each domain that you add, click Verify and following the instructions to verify the domain.
       
   12. After each domain is verified, you can sync your users and groups to the Barracuda Cloud Control.

   Add a New Azure Active Directory

   1. Select Azure Active Directory.
   2. On the INFO tab, specify a new Directory Name. For example, "Office 365". 
   3. Click CONNECT TO MICROSOFT to sign into Microsoft and authorize Barracuda Cloud Control to connect to your Azure Active Directory account.
      1. Log in with your Office 365 administrator credentials.
      2. Accept the credentials for the application request.
      

   4. Activate the Authentication option to have users authenticate using their Azure credentials. If you disable this option, users authenticate with Barracuda Cloud Control.

      Barracuda strongly recommends creating an additional administrator account using an independent domain that does not use Active Directory (AD) authentication. This allows you access to your Barracuda product account if your AD server goes down or fails.

   5. After you are redirected back to the Barracuda Cloud Control, click Save.

Associate a Role

1. Log into the Barracuda Cloud Archiving Service, and go to Users > LDAP User Add/Update.
2. In the LDAP User/Group field, enter the LDAP User or Group name to which the permissions apply.
3. Select the Role for the specified LDAP user or group account:
   1. User Role – Specify mailbox addresses to include or exclude from the LDAP account:

      • Include these Addresses – Enter a mailbox address that you wish to make available to the specified LDAP account, and then click Add.

      • Exclude these Addresses – Enter a mailbox address that you wish to hide from the specified LDAP account, and then click Add.

   2. Auditor Role – Configure the desired permissions:

      • Domains – Enter a domain for which the auditor can view mail, and then click Add.

      • Saved Search – Define Saved Searches on the Basic > Search page, and then select the desired Saved Search from the drop-down menu to filter the auditor's search results.

      • Exclude these addresses – Enter a mailbox address that you want to hide from the specified LDAP account, and then click Add.

   3. Admin Role – Specify mailbox addresses that you want to hide from the specified LDAP account, and then click Add.

4. Click Save.

For end-user authentication, refer to How to Set Up LDAP Groups for End-User Authentication.

Manually Add Local Accounts

Local accounts reside only on the Barracuda Cloud Archiving Service.

1. Log into the the Barracuda Cloud Archiving Service, and go to Users > LDAP User Add/Update.
2. Enter the user's Email Address and the User Display Name.
3. Enter all aliases associated with the entered email address, one entry per line.
4. Enter the account password and select the user role for the account.
5. If you select the user role Auditor enter the following additional details:
   
   • Enter a domain for which the auditor can view messages and other Outlook items, and click Add. Any messages that includes an email address in the listed domains in either the From, To, or CC/Bcc areas, or any items that belong to a user in the specified domains, display in search results. To allow the auditor to view all items from all domains, leave this field blank.
   • In the Saved Search drop-down menu, select a defined Saved-Search to automatically apply to all searches performed by this auditor. Note that the parameters in the Saved Search take precedence over any domain limitations that may be specified above, as well as over any attempts by the auditor to Search As any other account.

Step 3. Obtain Your Journaling Address

1. Log into the Barracuda Cloud Archiving Service, and go to Mail Sources > SMTP Journaling.
2. Verify your journaling address.

Step 4. Configure G Suite

• G Suite Enterprise – If you are using G Suite Enterprise, use the steps in the section G Suite Enterprise Configuration below.
• G Suite; non-Enterprise version – If you are using a version of G Suite that is not G Suite Enterprise, use the steps in the section G Suite Configuration below.

G Suite Enterprise Configuration

1. Log into your Google Admin console at https://admin.google.com.
2. From the Home page, go to Apps > G Suite > Gmail > Advanced settings.
3. Scroll to Advanced settings at the bottom of the page.
4. In the Third-party email archiving section, enter a unique name to identify the setting.
5. In the Send journal messages to this email address field, enter your journaling address from the Barracuda Cloud Archiving Service Mail Sources > SMTP Journaling page:
   
6. Click Add setting, and click Save.

G Suite Configuration

Use the following steps to configure G Suite. If you are using G Suite Enterprise, use the steps in the previous section, G Suite Enterprise Configuration.

1. Log into your Google Admin console at https://admin.google.com.
2. From the Home page, go to Apps >  G Suite  > Gmail >  Advanced settings.
3. Scroll to Routing, and click Configure.
4. Enter a unique name to identify the setting, and select all check boxes under Messages to affect:
   
5. In the Also deliver to section, click Add more recipients, and click Add.
6. Under Recipients, select Advanced from the drop-down menu.
7. In the Envelope recipient section, select Change envelope recipient.
8. In the Replace recipient field, enter the journaling address from the Barracuda Cloud Archiving Service Mail Sources > SMTP Journaling page.
9. Clear Do not deliver spam to this recipient and select Suppress bounces from this recipient:
    
10. Click Save. Select Require secure transport (TLS):
    
11. Click Add Setting, and click Save.