McAfee SG310, Administration Manual

Page: 229 / 412

McAfee UTM Firewall 4.0.4 Administration Guide 229
Firewall menu options
Antivirus
4
[Optional] To enable a transparent mode of operation, select the Transparent checkbox. When enabled,
all POP3 network traffic crossing the appliance is transparently proxied. The proxy server initiates
connections on behalf of the original user and virus checks incoming email messages.
5
[Optional} Adjust the number of seconds elapsed before a time-out in the Request timeout field.
Typically, it is not necessary to adjust the default value for POP3 protocol.
• Default: 600
• Can be a value of 1 or greater
6
[Optional] To customize the text in the blocked message notification, enter a string in the Identification
field. The name indicates the sender of the notification.
Default: McAfee Anti-Virus
7
[Optional] Once you determine POP scanning is functioning properly, reduce syslog output by selecting
the Reduce syslog output checkbox.
8
Click Submit.
Scanning POP email for specific clients only
For each of the email clients for which to scan incoming mail, the email client’s POP3 user name setting
must be in the form of
user@mail.isp.com
, rather than simply “user” –
user
is the POP3 login, and
mail.isp.com
is the POP3 mail server. Additionally, the email client’s incoming/POP3 email server setting
must be sent to the UTM Firewall appliance’s LAN IP address (for example, 192.168.0.1).
1
From the Firewall menu, click Antivirus > POP email tab.
2
Select the Virus check POP based email checkbox.
3
Leave Default POP server blank.
4
Select the Allow connections to other POP servers checkbox.
5
Clear the Transparent checkbox.
6
Typically it is not necessary to adjust the default value for POP3 protocol Request timeout field.
7
Once POP scanning is functioning properly, select the Reduce syslog output checkbox to reduce syslog
output.
8
Click Submit.
Viewing POP email antivirus statistics
The Antivirus Statistics table is located at the bottom of the POP Email tab. This table provides a summary
of all viruses detected in POP email.
The Server column lists the POP3 server that sent the infected email.
The User column lists the username of the user who connected to the POP3 server.
The Client column lists the client machine used to connect to the POP3 server.
The How Long Ago column lists the time elapsed since the infected email was received.
Virus scanning SMTP email
If you have an SMTP mail server on your LAN, the appliance antivirus can scan emails sent to it by external
mail servers.