Configuring App Security Groups for email notifications

Last Updated March 13, 2025

You can configure App Security Groups (ASGs) to give network access to the Notifications Service.

To allow the Notifications Service to have network access, you must create App Security Groups (ASG). You cannot use the Notifications Service without ASGs.

For more information, see App Security Groups.

Prerequisite

Before configuring ASGs for the Notifications Service, you must first set up the Notifications Service. To set up the Notifications Service, see Getting Started with the Notifications Service.

Configure network connections

The Notifications Service is deployed as a suite of apps to the notifications-with-ui space in the system org. It requires the following outbound network connections:

Destination	Ports	Protocol	Reason
`SMTP_SERVER`	587 (default)	tcp (default)	This service is used to send out email notifications.
`LOAD_BALANCER_IP`	80, 443	tcp	This service accesses the load balancer.
`ASSIGNED_NETWORK`	3306	tcp	This service requires access to internal services. `ASSIGNED_NETWORK` is the CIDR of the network assigned to this service.

The SMTP server port and protocol are dependent on how you configure your server.

Create a SMTP server ASG

To create an ASG for your SMTP server:

Go to the Tanzu Operations Manager Installation Dashboard.
Click the VMware Tanzu Platform for Cloud Foundry (Tanzu Platform for Cloud Foundry) tile.
Select Email Notifications.
Record the values in the SMTP server address and SMTP server port fields.
Using the SMTP server address you obtained in the previous step, find the IP addresses and protocol of your SMTP server from the service you are using. You might have to contact your service provider for this information.

Create a smtp-server.json file. For destination, you must enter the IP address of your SMTP Server.

[
    {
        "protocol": "tcp",
        "destination": SMTP_SERVER_IPS,
        "ports": "587"
    }
]

Create an ASG called smtp-server by running:

cf create-security-group smtp-server smtp-server.json

Create an assigned network ASG

If you use external services, the IP addresses, ports, and protocols depend on the service.

To create an ASG for an assigned network:

Go to the Tanzu Operations Manager Installation Dashboard.
Click the Tanzu Platform for Cloud Foundry tile.
Select Assign AZs and Networks.
Record the network selected in the Network dropdown.
Return to the Tanzu Operations Manager Installation Dashboard.
Click the BOSH Director tile.
Select Create Networks.
Record the CIDR for the network you identified in Assign AZs and Networks. Ensure the subnet mask allows the space to access p-mysql, p-rabbitmq, and p-redis.

Create a file assigned-network.json. For the destination, enter the CIDR you recorded above.

[
    {
        "protocol": "tcp",
        "destination": "10.68.0.0/20",
        "ports": "3306,5672,6379"
    }
]

Create an ASG called assigned-network by running:

cf create-security-group assigned-network assigned-network.json

Bind the ASGs

After creating your ASGs, you must bind them to the Notifications Service.

To bind your ASGs to the Notifications Service:

Target the system org by running:
```
cf target -o system
```
Create a notifications-with-ui space by running:
```
cf create-space notifications-with-ui
```

Bind the ASGs you created in this topic to the notifications-with-ui space by running:

cf bind-security-group smtp-server system notifications-with-ui
cf bind-security-group assigned-network system notifications-with-ui

Content feedback and comments

Tanzu Platform for Cloud Foundry 10.0