Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 350 / 861

349 Preventing attacks
Increasing productivity by identifying spam email
Troubleshooting antivirus protection
By configuring the antivirus feature of the security gateway, you have fine-grained control over the
email attachments and files that come through your security gateway; however, the combination of the
different scanning mechanisms can inadvertently block content you really need to receive.
The most common problem with antivirus transfers is that the file is not downloaded in its entirety
because of a timeout. If you experience this problem, use the following techniques:
Increasing productivity by identifying spam email
Spam is unsolicited bulk email, most often advertising messages for a product or service. Spam email
wastes user productivity and consumes network and mail server resources. The security gateway
provides scanning processes that let you identify spam. You can also configure how to respond to spam
email.
When enabled, the security gateway scans email that arrives through the SMTP protocol. If your
organization permits users to retrieve email from external mail servers, you can also scan mail that is
handled by the POP3 protocol. You enable the antispam settings for each protocol on a rule-by-rule
basis.
Email that arrives at the security gateway by way of the SMTP protocol is scanned before it is
delivered; therefore, blocking a message is possible. Email that uses the POP3 protocol can only be
scanned after it has been delivered to a mailbox, but before it is read by a user. You cannot block POP3
email, because there is no way to remove the infected mail from the mailbox.
Email messages that are identified as spam are automatically logged. This lets you monitor what
percentage of mail passing through the gateway is identified as spam.
You must have a valid Content Security license to enable the heuristics scanning and subject pattern
matching processes. All of the other antispam processes require a Firewall Base license.
See “Understanding and using licenses” on page 86.
This section includes the following topics:
■
About the antispam scanning process
■
Identifying spam email
■
Reducing false positives
■
Adding antispam protection to a rule
Enable data comforting if it is not already enabled. See “Avoiding potential session time-out
errors” on page 340.
If you have problems transferring files of a particular file type,
add that file type to the list of files that are not scanned.
This is not advised for a single file transfer; no files with the
excluded extension are scanned while this setting is in effect.
See “Specifying file types to scan” on page 338.
Change the comforting settings for the transfer protocol to lower
the wait time and trickle rate. (Data comforting is not available for
SMTP.) See “Avoiding potential session time-out
errors” on page 340.
Create a specific rule that does not use antivirus or DDR scanning
for this particular traffic.
This is the preferred method for a single file transfer because it is
easy to remove.
See “Creating basic rules” on page 273.