Allow list SAT Emails in Barracuda

Team: Huntress SAT (Security Awareness Training)
Product: Barracuda email filtering
Environment: Barracuda and SAT management portals
Summary: If you are using the Email Security Gateway from Barracuda (cloud or self-hosted), you can add SAT to Barracuda's Allow-list to allow our services to run on your network.

For an up-to-date list of addresses and domains, visit Generic Mail Server Allow-listing. 

You can access the full list of SAT IP addresses and domains to allow-list by logging into your Admin dashboard. 

After logging in, select 'Settings' and then 'Phishing' from the vertical menu on the left-hand side to navigate to the 'Phishing' tab.

To allow-list SAT with Barracuda please follow the instructions provided in the 3 sections below. Standard allow-list, Phishing allow-list Intent Analysis, and Sender Authentication

Standard Allow-list Barracuda Cloud Control: 

1. Log in to your Barracuda Cloud Control
2. Go to Email Security Inbound Settings IP Address Policies
3. In the IP Blocking / Exemption section, use the top line to enter one of our IP addresses. This process will need to be repeated for each IP address.
4. In the Netmask field, type 255.255.255.255
5. Set the Policy field to Exempt
6. In the Comment field add SAT Phishing Simulation
7. Click Add to allow-list the IP address
8. Repeat steps for any other necessary SAT domains and IP Addresses.

• 18.205.140.116 (SAT Phishing Server)
• 168.245.36.66 (SAT Training Server)

Standard Allow-list Email Security Gateway (on-premises):

1. Sign into the admin portal
2. Navigate to the BLOCK/ACCEPT IP Filters page
3. Under Allowed IP/Range, enter the first SAT mail server IP in the IP/Network Address field.
4. Enter 255.255.255.255 into the netmask field
5. Optional: Add a note describing what this entry is for. For example, SAT Phishing Server
6. Select Add to allow-list
7. Repeat steps for any other necessary SAT domains and IP Addresses.

• 18.205.140.116 (SAT Phishing Server)
• 168.245.36.66 (SAT Training Server)

Phishing Allow-list Intent Analysis

It may be necessary to allow-list SAT in Barracuda's Intent Analysis feature to prevent the links in our phishing tests from being changed, or potentially adding bias to phishing test results. More information on this can be found in Barracuda's Knowledge Base

If you are using Barracuda's Email Security Service (Cloud), follow these steps to allow-list Barracuda's Intent Analysis:

1. Log in to your Barracuda Cloud Control
2. Navigate to Email Security Inbound Settings Anti-Phishing
3. Under the Intent section, add SAT's hostnames. Make sure the Policy drop-down is set to Ignore

If you are using Barracuda's Email Security Gateway (on-premises), follow these steps to allow-list Barracuda's Intent Analysis:

1. Log in to your Barracuda Email Security Gateway web interface
2. Navigate to Email Security Gateway Basic Spam Checking
3. Under the Intent Analysis section, add SAT's hostnames to the URI Exemptions: text box field

• phish.mycurricula.com
• securitynotifications.org
• security-updater.com
• amazonsecurity.org
• breach-notice.com
• filesharingnow.com
• mailbox-quota.com
• passwordsnotification.com
• securelinkedin.com
• fraud-assistance.com
• payment-process.com
• news-article.com
• invite-meeting.com
• feedback-collect.com
• businessnotice.org
• databoxonline.com
• electronic-hr.com
• emailtransaction.com
• employee-services.org
• governmentnotice.org
• notificationservices.org

Sender Authentication (SPF)

As an added feature, you can exempt Trusted Forwarder IP addresses from SPF checks to fake your own domain while using our Phishing Tests. More information can be located in Barracuda's Knowledge Base

If you are using Barracuda's Email Security Service (Cloud), follow these steps to allow-list Barracuda's Sender Authentication:

1. Log in to your Barracuda Cloud Control
2. Navigate to Email Security Inbound Settings Sender Authentication
3. In the Use Sender Policy Framework center enter SAT's IP addresses in the SPF exemptions table

If you are using Barracuda's Email Security Gateway (on-premises), follow these steps to allow-list Barracuda's Sender Authentication:

1. Log in to your Barracuda Email Security Gateway web interface
2. Navigate to Email Security Block/Accept tab and select Sender Authentication
3. Under Sender Policy Framework (SPF) Configuration section, select Yes
4. Add SAT's IP addresses to the exemption list.

• 18.205.140.116 (SAT Phishing Server)
• 168.245.36.66 (SAT Training Server)