CyberGraph Implementation Issues - Jan 2021

Known Issue

Date Logged	March 10th, 2023
Product(s)	CyberGraph
Status	Not Fixing

Issue

Customers implementing CyberGraph (that have other cloud solutions configured in Microsoft Exchange Online), may encounter an issue where email is not processed by both CyberGraph and the other solution. 

Explanation

The problem appears to be related to how Microsoft processes messages when there is more than one mail flow rule configured to route messages using a connector. This issue can occur with customers that have either CodeTwo or Exclaimer, both of which apply signatures; however, the issue is not limited to just these products.

Workaround

The solution outlined below is specifically for solutions that apply signatures. Adjustments may need to be made for other solutions.

For Customers Applying Signatures to Outbound Email Only

To modify the mail flow rule used for applying signatures:

1. Add a condition: The senders IP address is in the range or exactly matches – 52.55.191.64/26.
2. Enable Stop processing more rules.
3. Change the priority of the rule to 0.
4. Do not make any changes to the configured exceptions.

After making the changes the MessageControl Loop Check rule should be priority 1.

For Customers Applying Signatures to Internal and Outbound Email

Some customers may already have separate rules for internal signatures vs. external signatures. However, if there is only one rule, you’ll need to have the customer create a new rule as well as modify the existing rule.  CyberGraph doesn’t process internal email so the condition that looks for the IP address of the sender will never be met for internal emails.
If the customer only has one rule, generally it’s configured to process email coming from a specific group or from internal.  Using this assumption:
Copy the existing rule and modify the name i.e. Signatures for internal email.

1. Add a condition: “the recipient is internal”
2. Do not make any changes to the configured exceptions.

The priority of this rule shouldn’t matter. You may decide to add it just after the current rule.

Modify the mail flow rule used for applying signatures:

1. Modify the name – Signatures for external email.
2. Add a condition: "the recipient is external"
3. Add a condition: The senders IP address is in the range or exactly matches – 52.55.191.64/26.
4. Enable Stop processing more rules.
5. Change the priority of the rule to 0.
6. Do not make any changes to the configured exceptions.

After making the changes, the MessageControl Loop Check rule should be priority 1 or 2 depending on the priority of the new internal signature rule.

Mail Flow After Making the Changes.

The below does not apply to internal email.  Internal email is not processed by MessageControl.  Signatures will be applied by the CodeTwo rule defined for processing internal email.

• Users sends an email. 
• Email routes to Exchange online and the mail flow rules begin processing.
• The modified CodeTwo/Exclaimer rule is ignored because the senders IP is not within the defined range 52.55.191.64/26.
• Processing of mail flow rules continues. 
• Based on mail flow rules email is routed to MessageControl for processing. 
• MessageControl routes email back to Exchange online.
• Exchange online begins processing the mail flow rules again. 
• The senders IP now falls within the defined range of the modified CodeTwo/Exclaimer rule.
• Email is routed to CodeTwo/Exclaimer.
• Email is routed back from CodeTwo/Exclaimer to Exchange online.
• Exchange online begins processing the mail flow rules.
• Email is processed by MessageControl Loop Check rule.
• Email meets the conditions defined in the MessageControl Loop Check rule and rule processing stops.
• Message is routed out for delivery.

When testing, keep in mind, propagation can take significant time for all Microsoft tenants to be updated so you may see inconsistent results until the configuration has fully propagated.