McAfee SG310, Руководство администратора

Страница: 234 / 412

234 McAfee UTM Firewall 4.0.4 Administration Guide
Firewall menu options
Antispam (TrustedSource)
Figure 234 TrustedSource query example
Licensing is handled by the TrustedSource server. Once enabled, TrustedSource automatically starts
filtering all inbound mail; you do not need to alter the existing rules or create new rules.
Note: You should not create a port forward or destination NAT rule to allow incoming SMTP if you are using
TrustedSource. If you are not using TrustedSource, NAT or port forward rules may be required to allow incoming
SMTP.
TrustedSource Reputation Scores
Trustworthy senders receive low scores and untrustworthy senders receive high scores ranging from -127
to +127. The delineating values and corresponding descriptions are described in
Table :
Enabling TrustedSource
Use the following procedure to enable and configure TrustedSource for the UTM Firewall appliance. The mail
server must be configured as an SMTP-proxy.
Security Alert: Since antivirus for SMTP email and TrustedSource share SMTP resources, only one SMTP server
can be protected by these features.
Prerequisites:
• DNS is configured with access to the Internet. Refer to
DNS .
• The UTM Firewall appliance is located on the perimeter of your network and is not behind another firewall.
• Be sure you have entered the serial number of your UTM Firewall appliance on the Device tab . The serial
number of the appliance is used as the serial number for the TrustedSource licensing and is required to
enable TrustedSource in a UTM Firewall appliance.
• You have registered your appliance and activated the feature. For more information, see Registering your
UTM Firewall , and Activating a feature .
To enable TrustedSource filtering:
Table 18 TrustedSource reputation classes
Value Description
< 0 (negative values) Trusted
0 through 14 Neutral
15 through 29 Unverified
30 through 49 Suspicious
50 or greater Malicious
spammer.example.net
1.1.1.1
internal
mail server
SMTP-proxy
UTM Firewall
TrustedSource
spammer.example net
1.1.1.1
spammer.example.net
1.1.1.1 = 110/SPAM
1
2
3
4b
REJECT
4a