D-Link 800 - DFL 800 - Security Appliance, User Manual

Page: 208 / 469

This is a very useful feature to have since it is possible to put
in a block against either an infected client or an infected
server sending large amounts of malware generated emails.
Email Size Limiting A maximum allowable size of email messages can be
specified. This feature counts the total amount of bytes sent
for a single email which is the header size plus body size plus
the size of any email attachments after they are encoded. It
should be kept in mind that an email with, for example, an
attachment of 100 Kbytes, will be larger than 100 Kbytes.
The transferred size might be 120 Kbytes or more since the
encoding which takes place automatically for attachments
may substantially increase the transferred attachment size.
The administrator should therefore add a reasonable margin
above the anticipated email size when setting this limit.
Email address blacklisting A blacklist of sender or recipient email addresses can be
specified so that mail from/to those addresses is blocked. The
blacklist is applied after the whitelist so that if an address
matches a whitelist entry it is not then checked against the
blacklist.
Email address whitelisting A whitelist of email addresses can be specified so that any
mail from/to those addresses is allowed to pass through the
ALG regardless if the address is on the blacklist or that the
mail has been flagged as SPAM.
Verify MIME type The content of an attached file can be checked to see if it
agrees with its stated filetype. A list of all filetypes that are
verified in this way can be found in Appendix C, Verified
MIME filetypes. This same option is also available in the
HTTP ALG and a fuller description of how it works can be
found in Section 6.2.2, “The HTTP ALG”.
Block/Allow filetype Filetypes from a predefined list can optionally be blocked or
allowed as mail attachments and new filetypes can be added
to the list. This same option is also available in the HTTP
ALG and a fuller description of how it works can be found in
Section 6.2.2, “The HTTP ALG”. This same option is also
available in the HTTP ALG and a fuller description of how it
works can be found in Section 6.2.2, “The HTTP ALG”.
Anti-Virus Scanning The NetDefendOS Anti-Virus subsystem can scan email
attachments searching for malicious code. Suspect files can
be dropped or just logged. This feature is common to a
number of ALGs and is described fully in Section 6.4,
“Anti-Virus Scanning”.
The Ordering for SMTP Filtering
SMTP filtering obeys the following processing order and is similar to the order followed by the
HTTP ALG except for the addition of SPAM filtering:
1. Whitelist.
2. Blacklist.
3. SPAM filtering (if enabled).
6.2.5. The SMTP ALG Chapter 6. Security Mechanisms
208