Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 227 / 861

227 Defining your security environment
Controlling full application inspection of traffic
Related information
For further information related to this topic, see the following:
■
“Proxy Properties: RTSPD—General tab” on page 717
■
“Rule Properties—General tab” on page 589
Managing electronic mail
To address a wide range of potential email security issues, the security gateway offers two application
proxies: one that monitors email sent to a mail server (SMTP) and the other that monitors email
received from a server. The SMTP and POP3 proxies accept or reject delivery of email on a connection-
by-connection basis, subject to the existence of authorization rules, based on current RFC
recommendations. In addition to checking for RFC compliancy, you can also scan all email for known
email-based forms of attack.
Note:
Because the security gateway’s SMTP proxy is not a mail server and does not store email, the
security gateway itself is not vulnerable to email-based attacks.
How the security gateway manages electronic mail
When configured, all SMTP and POP3 traffic passing through the security gateway is inspected by its
respective application proxy. Each proxy is responsible for checking the data stream and ensuring that
it complies with current RFC specifications. Additionally, headers are checked for potential buffer
overflows or malformed packets. If enabled, the data stream is also passed to the antivirus engine so
that exhaustive checks prevent the introduction of an email-based virus.
Note: With the appropriate allow authorization rule, the security gateway automatically establishes
transparent, bi-directional access for email connections; all email connections work in both directions,
without requiring you to set up two separate rules for traffic flow (one inbound and one outbound).
Outbound email example
You want to ensure that any email sent by anyone in your organization is first checked before it leaves
your network. There are several ways to implement this check on your network, but the most common
is to have your company’s email server protected by the security gateway (placed on the internal
network), and have all of your users interact with the mail server as they normally would. The only
change you need to make is to force all traffic from the mail server to pass through a SMTP proxy-
configured security gateway before moving on to its intended destination.
The benefit to this approach is that there is no individual configuration of your organization’s
employees email clients; they send email as they normally would with the IP address or DNS-resolvable
name of the email server in their email client’s configuration. All traffic from the protected email
server is sent through the security gateway, where it is checked by the security gateway’s application
proxies before being forwarded.