Symantec Mail Security for SMTP Planning Manual

Brand: Symantec

Model: Mail Security for SMTP

Category: Operating systems

Type: Planning Manual

This manual is also suitable for

10765539 - Mail Security For SMTP

Symantec Mail Security

for SMTP

Planning Guide

Symantec Mail Security for SMTP

Planning Guide

The software described in this book is furnished under a license agreement and

may be used only in accordance with the terms of the agreement.

April 17, 2006

logo, Symantec TurnTide, and SESA are U.S. registered trademarks of Symantec

Corporation. LiveUpdate, LiveUpdate Administration Utility, Symantec AntiVirus, and

Symantec Security Response are trademarks of Symantec Corporation. Other names may

be trademarks of their respective owners.

The product described in this document is distributed under licenses restricting its use,

copying, distribution, and decompilation/reverse engineering. No part of this document

may be reproduced in any form by any means without prior written authorization of

Symantec Corporation and its licensors, if any.

THE DOCUMENTATION IS PROVIDED “AS IS” AND ALL EXPRESS OR IMPLIED

CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED

WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-

INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH

DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL

NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION

WITH THE FURNISHING PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE

INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE

WITHOUT NOTICE.

The Licensed Software and Documentation are deemed to be “commercial computer

software” and “commercial computer software documentation” as defined in FAR

Sections 12.212 and DFARS Section 227.7202.

Symantec Corporation

20330 Stevens Creek Blvd.

Cupertino, CA 95014

http://www.symantec.com

Printed in the United States of America.

10987654321

Technical support

As part of Symantec Security Response, the Symantec global Technical Support

group maintains support centers throughout the world. The Technical Support

group’s primary role is to respond to specific questions on product feature/

function, installation, and configuration, as well as to author content for our

Web-accessible Knowledge Base. The Technical Support group works

collaboratively with the other functional areas within Symantec to answer your

questions in a timely fashion. For example, the Technical Support group works

with Product Engineering as well as Symantec Security Response to provide

Alerting Services and Virus Definition Updates for virus outbreaks and security

alerts.

Symantec technical support offerings include:

■ A range of support options that give you the flexibility to select the right

amount of service for any size organization

■ Telephone and Web support components that provide rapid response and

up-to-the-minute information

■ Upgrade insurance that delivers automatic software upgrade protection

■ Content Updates for spam and virus definitions, and security signatures

that ensure the highest level of protection

■ Global support from Symantec Security Response experts, which is

available 24 hours a day, 7 days a week worldwide in a variety of languages

for those customers enrolled in the Platinum Support Program

■ Advanced features, such as the Symantec Alerting Service and Technical

Account Manager role, offer enhanced response and proactive security

support

Please visit our Web site for current information on Support Programs. The

specific features available may vary based on the level of support purchased and

the specific product that you are using.

Licensing and registration

If the product that you are implementing requires registration and/or a license

key, the fastest and easiest way to register your service is to access the

Symantec licensing and registration site at www.symantec.com/certificate.

Alternatively, you may go to www.symantec.com/techsupp/ent/enterprise.html,

select the product that you wish to register, and from the Product Home Page,

select the Licensing and Registration link.

Contacting Technical Support

Customers with a current support agreement may contact the Technical

Support group via phone or online at http://www.symantec.com/enterprise/

Customers with Platinum support agreements may contact Platinum Technical

Support via the Platinum Web site at https://www-secure.symantec.com/

platinum/

When contacting the Technical Support group, please have the following:

■ Product release level

■ Hardware information

■ Available memory, disk space, NIC information

■ Operating system

■ Version and patch level

■ Network topology

■ Router, gateway, and IP address information

■ Problem description

■ Error messages/log files

■ Troubleshooting performed prior to contacting Symantec

■ Recent software configuration changes and/or network changes

Customer Service

To contact Enterprise Customer Service online, go to http://www.symantec.com,

select the appropriate Global Site for your country, then choose Service and

Support. Customer Service is available to assist with the following types of

issues:

■ Questions regarding product licensing or serialization

■ Product registration updates such as address or name changes

■ General product information (features, language availability, local dealers)

■ Latest information on product updates and upgrades

■ Information on upgrade insurance and maintenance contracts

■ Information on Symantec Value License Program

■ Advice on Symantec's technical support options

■ Nontechnical presales questions

■ Missing or defective CD-ROMs or manuals

Contents

Chapter 1 Introducing Symantec Mail Security for SMTP

Key features ............................................................................................................ 7

Functional overview .............................................................................................. 8

Architecture ............................................................................................................ 9

New features for all users ................................................................................... 10

Changes for Symantec Mail Security for SMTP users ................................... 11

New feature names ......................................................................................13

Discontinued features .................................................................................13

Changes for Symantec Brightmail Antispam users ....................................... 13

Where to get more information .........................................................................15

Chapter 2 Planning your deployment

General deployment considerations .................................................................17

MTA usage .................................................................................................... 17

Configuring Scanners ..................................................................................17

Positioning with other filtering products ................................................18

Filtering internal deliveries .......................................................................18

LDAP compatibility ..................................................................................... 18

Load balancing ............................................................................................. 19

Adjusting MX records ..................................................................................19

Adjusting RAM and MySQL threads ......................................................... 19

Deployment models .............................................................................................20

Basic gateway deployment ......................................................................... 20

Multi-tier gateway deployment ................................................................. 21

Post-gateway deployment .......................................................................... 23

Chapter 3 Configuring message filtering

Understanding email filtering ...........................................................................25

Notes on filtering actions ........................................................................... 25

Deployment considerations ...............................................................................26

6 Contents

Chapter 4 Understanding system requirements

Hardware and software requirements ............................................................. 27

Minimum hardware requirements ............................................................ 27

Minimum software requirements ............................................................. 28

Reserved ports .............................................................................................. 31

Factors that affect performance ....................................................................... 32

Hardware components that affect performance .................................... 32

Environmental factors that affect performance .................................... 33

Settings that affect performance .............................................................. 33

Index

Chapter

Introducing Symantec Mail

Security for SMTP

This chapter includes the following topics:

■ Key features

■ Functional overview

■ Architecture

■ New features for all users

■ Changes for Symantec Mail Security for SMTP users

■ Changes for Symantec Brightmail Antispam users

■ Where to get more information

Key features

Symantec Mail Security for SMTP offers enterprises an easy-to-deploy,

comprehensive gateway-based email security solution through the following:

■ Antispam technology – Symantec’s state-of-the-art spam filters assess and

classify email as it enters your site.

■ Antivirus technology – Virus definitions and engines protect your users

from email-borne viruses.

■ Content Compliance – These features help administrators enforce corporate

email policies, reduce legal liability, and ensure compliance with regulatory

requirements.

■ Group policies and filter policies – An easy-to-use authoring tool lets

administrators create powerful, flexible ad hoc filters for userss and groups.

8 Introducing Symantec Mail Security for SMTP

Functional overview

You can deploy Symantec Mail Security for SMTP in different configurations to

best suit the size of your network and your email processing needs.

A Symantec Mail Security for SMTP host can be deployed in the following ways:

■ Scanner – Deployed as a Scanner, a Symantec Mail Security for SMTP host

filters email. Your installation can have one or many Scanners. Symantec

Mail Security for SMTP runs alongside your email or groupware server(s).

■ Control Center – Deployed as a Control Center, a Symantec Mail Security for

SMTP host is a Web-based configuration and administration center. Use it to

configure and manage email filtering, SMTP routing, system settings, and

all other functions. Your enterprise-wide deployment of Symantec Mail

Security for SMTP can have multiple Scanners but only one Control Center,

from which you configure and monitor all the Scanner hosts.

The Control Center provides status for all Symantec Mail Security for SMTP

hosts in your system, system logs, and extensive customizable reporting.

Use it to configure both system-wide and host-specific details.

The Control Center provides the Setup Wizard, for initial configuration of

all Symantec Mail Security for SMTP instances at your site, and also the

Add Scanner Wizard, for adding new Scanners.

It also hosts the Spam and Suspect Virus Quarantines, for storage of spam

and virus messages respectively. End users can access the Control Center to

view their quarantined spam messages and set their preferences for

language filtering and blocked and allowed senders. Alternatively, you can

configure the Spam Quarantine for administrator-only access.

■ Scanner and Control Center – A single Symantec Mail Security for SMTP

host performs both functions.

Note: Symantec Mail Security for SMTP provides neither mailbox access for end

users nor message storage; it is not intended for use as the only MTA in your

email infrastructure.

Note: Symantec Mail Security for SMTP does not filter messages that don’t flow

through the SMTP gateway. For example, if two mailboxes reside on the same

MS Exchange server, or on different Exchange servers the same organization,

messages will not pass through Symantec Mail Security for SMTP filters.

9Introducing Symantec Mail Security for SMTP

Architecture

Your Symantec Mail Security for SMTP installation processes a email message

as follows. For the sake of discussion, our sample message passes through the

Filtering Engine to the Transformation Engine without being rejected.

10 Introducing Symantec Mail Security for SMTP

New features for all users

■ The incoming connection arrives at the inbound MTA via TCP/IP.

■ The inbound MTA accepts the connection and moves the message to its

inbound queue.

■ The Filtering Hub accepts a copy of the message for filtering.

■ The Filtering Hub consults the LDAP SyncService directory to expand the

message’s distribution list.

■ The Filtering Engine determines each recipient’s filtering policies.

■ The message is checked against Blocked/Allowed Senders Lists defined by

administrators.

■ Virus and configurable heuristic filters determine whether the message is

infected.

■ Content Compliance filters scan the message for restricted attachment types

or keywords, as defined in configurable dictionaries.

■ Spam filters compare message elements with current filters published by

Symantec Security Response to determine whether the message is spam. At

this point, the message may also be checked against end-user defined

Language settings.

■ The Transformation Engine performs actions per recipient based on

filtering results and configurable Group Policies.

New features for all users

Table 1-1 lists features that are new for both Symantec Mail Security for SMTP

users and Symantec Brightmail Antispam users.

Table 1-1 New features for Symantec Mail Security for SMTP and Symantec Brightmail Antispam

Category Features Description

Threat

protection

features

Improved Email Firewall Protects against directory harvest attacks, denial of service

attacks, spam attacks, and virus attacks.

Sender Authentication Protects against phishing attacks, using the Sender Policy

Framework (SPF), Sender ID, or both.

Improved virus protection Additional virus verdicts protect against suspected viruses,

spyware and adware, and encrypted attachments.

Email messages that may contain viruses can be delayed in the

Suspect VIrus Quarantine, then refiltered, with updated virus

definitions, if available. This feature can be effective in defeating

virus attacks before they are widely known.

View a continuously updated list available of virus definitions.

11Introducing Symantec Mail Security for SMTP

Changes for Symantec Mail Security for SMTP users

For users of Symantec Mail Security for SMTP 4.1, Version 5.0 provides a host of

expanded and improved capabilities. In addition to the new features listed in

Inbound and

outbound

content

controls

True file type recognition for

content compliance filtering

Automatically detects file types without relying on file name

extensions or MIME types.

Keywords filtering within

attachments, keyword

frequency filtering

Scan within attachments to find keywords from dictionaries you

create or edit. Specify a number of occurrences to look for.

Regular expression filtering Use regular expressions to further customize filter conditions by

searching within messages and attachments.

Support for third party

archival tools

Specify conditions that result in email being sent to an archival

email address or disk location.

Flexible mail

management

LDAP integration and

synchronization for policies

Dynamic group population via any of several supported LDAP

servers

Expanded variety of actions

and combinations

More than two dozen actions that can be taken on messages, with

many combinations of multiple actions available.

Expanded mail controls SMTP connection management, support for secure email (TLS

encryption), user-based routing, address masquerading, invalid

recipient handling, control over delivery queue processing,

support for static routes

Aliasing Distribution lists automatically expanded, mail filtered and

delivered correctly for each user

Improved

reporting and

monitoring

Extensive set of pre-built

reports, scheduled reporting,

additional alert conditions,

remote syslog support

More than 50 graphical reports that you can generate ad-hoc or

on a scheduled basis. Reports can be exported for offline analysis

and emailed.

Message tracking View a trail of detailed information about a message, including

the filtering processing applied to a message.

Expanded

administration

capabilities

IP-based access control Control which hosts and networks can access your Control Center.

Control over Quarantine size

limits

Specify user-based and total limits, configure automatic message

deletions.

Table 1-1 New features for Symantec Mail Security for SMTP and Symantec Brightmail Antispam

Category Features Description

12 Introducing Symantec Mail Security for SMTP

Changes for Symantec Mail Security for SMTP users

Table 1-1, additional new features for Symantec Mail Security for SMTP users

only are listed in Table 1-2.

Group Policies introduce expanded flexibility in mail filtering and message

handling. Group Policies enable you to specify groups of users, based on email

addresses, domains, or IP addresses, and customize mail filtering for each

group. See the Symantec Mail Security for SMTP Administration Guide for more

information.

In addition, if you were using Version 4.1 without Premium AntiSpam, Version

5.0, with or without Premium AntiSpam provides much more extensive

capabilities for customizing both message filtering and the actions taken on

filtered messages.

Table 1-2 New features for Symantec Mail Security for SMTP users

Category Features Description

Flexible mail

management

Centralized, Web-

based administration

Use the Control Center to manage all aspects of email management and

spam, virus, and content filtering across all servers with one interface.

Group Policies Create separate inbound and outbound policies for an unlimited number

of groups of users. You can specify groups of users based on email

addresses, domains, LDAP groups, or IP addresses. For each category of

email, you can specify custom message handling for each group.

Expanded

notification

capabilities

Automatically send emails notifying specific persons or groups when

certain message conditions are encountered during message filtering.

Create different notifications for different conditions or user groups.

Inbound and

outbound

content controls

Improved

attachment blocking

Strip attachments within container files. Search within attachments

using regular expressions.

Improved

reporting and

monitoring

Aggregated logging

and reporting

Access logs for all messages from all servers via the Control Center.

Manage reports for all servers via the Control Center. Note that many of

the reporting features in SMS for SMTP 4.1 have been replaced in SMS

for SMTP 5.0 by the message tracking feature.

Expanded

administration

capabilities

Delegated

administration

Multiple administrator roles with view only or modify access to different

portions of the management interface.

13Introducing Symantec Mail Security for SMTP

Changes for Symantec Brightmail Antispam users

New feature names

Most features in Version 5.0 have similar names to the corresponding Version 4.1

features. Table 1-3 provides a cross-reference between selected Symantec Mail

Security for SMTP 4.1 features and Symantec Mail Security for SMTP 5.0

features that have different names.

Discontinued features

The following Symantec Mail Security for SMTP 4.1 features are not included in

Symantec Mail Security for SMTP 5.0:

■ Auto-generated whitelist

■ Logging of SMTP conversations

■ Hold Queue, automatic reordering of the Slow Queue

■ Return code support for DNS Blacklists

■ Configurable administrator timeout for the management interface

Changes for Symantec Brightmail Antispam users

Although the product name has changed, if you were a Symantec Brightmail

Antispam user you will find the user interface for Symantec Mail Security for

SMTP 5.0 quite familiar. Most features are named similarly, and the organization

of the user interface is quite similar. Most of the changes are new features.

For users of Symantec Brightmail Antispam, Symantec Mail Security for SMTP

Version 5.0 provides significant new and expanded capabilities. In addition to

Table 1-3 Version 4.1 to Version 5.0

Symantec Mail Security for SMTP 4.1

Feature Name

Symantec Mail Security for SMTP 5.0

Feature Name

Accounts Administration

Custom disclaimer Annotation

Scan policy Settings > Virus > Exclude Scanning tab

Routing Settings > Hosts > Edit > SMTP tab

14 Introducing Symantec Mail Security for SMTP

Changes for Symantec Brightmail Antispam users

the new features listed in Table 1-1, additional new features for Symantec

Brightmail Antispam users only are listed in Table 1-4.

While the names of features are largely the same, you will find some changes to

the organization of menus. Most importantly, you will now find a Policies menu

at the top level, breaking out Group Policies (under the Settings menu in

Symantec Brightmail Antispam 6.0.3), and including other items as well. See the

Symantec Mail Security for SMTP Administration Guide for an updated

explanation of how settings and policies interact.

Table 1-4 New features for Symantec Brightmail Antispam users

Category Features Description

Threat

protection

features

Improved virus

processing

LiveUpdate support for virus definitions, list of file types to exclude

from virus scanning, expanded container limit controls

Outbound filtering Provides spam, virus, and content compliance filtering on outbound

email messages. Specify different outbound and inbound policies for

each user group.

Flexible mail

management

More flexible Group

Policies

Use LDAP groups to populate groups for Group Policies.

Multiple actions Specify more than one action to take on specific categories of

messages to specific groups of recipients.

Inbound and

outbound

content controls

Expanded content

compliance filtering

capabilities

Expanded set of actions available on filtered messages, support for

multiple actions on the same messages

Attachment blocking Create lists of attachment types to remove. Strip attachments within

container files.

Annotations Automatically append or prepend text, such as legal disclaimers or

marketing tag lines, to messages.

Notifications Automatically send emails notifying specific persons or groups when

certain message conditions are encountered during message filtering.

Create different notifications for different conditions or user groups.

Improved

reporting and

monitoring

Expanded virus

monitoring

Virus outbreak alerts, expanded logging of virus events

Expanded logging Symantec Security Information Manager (SSIM) logging support

Expanded

administration

capabilities

Global reject or pause

of message scanning

During a virus outbreak, you can temporarily pause scanning until

new virus filters are in place.

15Introducing Symantec Mail Security for SMTP

Where to get more information

In addition to this Planning Guide, your Symantec Mail Security for SMTP

product comes with the following documentation:

■ Symantec Mail Security for SMTP Installation Guide

■ Symantec Mail Security for SMTP Administration Guide

■ Symantec Mail Security for SMTP Getting Started

Symantec Mail Security also includes a comprehensive help system that

contains conceptual and procedural information.

You can visit the Symantec Web site for more information about your product.

The following online resources are available:

Provides access to the technical support Knowledge

Base, newsgroups, contact information, downloads,

and mailing list subscriptions

www.symantec.com/

techsupp/ent/

enterprise.html

Provides information about registration, frequently

asked questions, how to respond to error messages,

and how to contact Symantec License Administration

www.symantec.com

/licensing/els/help/en/

help.html

Provides product news and updates www.enterprisesecurity.

symantec.com

Provides access to the Virus Encyclopedia, which

contains information about all known threats;

information about hoaxes; and access to white papers

about threats

www.symantec.com/

avcenter/global/index.html

16 Introducing Symantec Mail Security for SMTP

Where to get more information

Chapter

Planning your deployment

This chapter includes the following topics:

■ General deployment considerations

■ Deployment models

General deployment considerations

This section provides information about integrating Symantec Mail Security for

SMTP into your network.

MTA usage

Symantec Mail Security for SMTP contains a Message Transfer Agent (MTA),

which processes and relays messages to support filtering activities.

Note: Symantec Mail Security for SMTP provides neither mailbox access for end

users nor message storage; it is not suitable for use as the only MTA in your

email infrastructure.

Configuring Scanners

During installation, you can use a wizard to add a Scanner. Depending on your

filtering requirements and messaging environment, you may want to deploy

multiple Scanners and administer them via a single Control Center. In such

cases, you can dedicate Scanners to specific functions. For example, you might

want one Scanner to filter inbound mail and another to filter outbound mail.

18 Planning your deployment

General deployment considerations

Positioning with other filtering products

In order for Symantec Mail Security for SMTP’s spam and Content Compliance

filters to function properly, you should avoid placing the product behind other

filtering products (such as content filters) or MTAs that alter or remove pre-

existing message headers or modify the message body.

Filtering internal deliveries

You can force internal mail through Symantec Mail Security for SMTP to avoid

propagation of viruses and spam generated by email mass-mailing worms that

may have been picked up by individuals via Web browsing or downloading.

LDAP compatibility

Symantec Mail Security for SMTP supports LDAP for Spam Quarantine

authentication and synchronization.

The system’s LDAP SyncService feature synchronizes user, alias, and group data

from your company’s LDAP accessible directories with its own database.

SyncService lets Symantec Mail Security for SMTP re-normalize and index the

data to fit the needs of Scanner, Control Center, and Spam Quarantine while

minimizing impact on your directory infrastructure.

LDAP SyncService supports the following LDAP servers:

■ Windows 2000 Active Directory

■ Windows 2003 Active Directory

■ Sun Directory Server 5.2, Patch 4 (formerly known as the iPlanet

Directory Server) on Solaris 8 and 9, and Red Hat Linux

■ SunOne LDAP Server 5.2 , Patch 4

■ Lotus Domino LDAP Server 6.5

■ Exchange 5.5

■ other (used for authentication only)

Note: Only one LDAP source may be used for authentication. While the same

source may also be used for synchronization purposes, no other LDAP

directories may be used for authentication. This is especially important with

regard to Spam Quarantine. If email is being sent to Spam Quarantine where end

users will then process their quarantined messages, then all end users must

exist in the LDAP source used for authentication.

19Planning your deployment

General deployment considerations

For information on using LDAP SyncService, see the Symantec Mail Security for

SMTP Administration Guide.

Load balancing

Symantec Mail Security for SMTP is not intended to be used for load balancing.

Administrators can associate only one host name or IP address as the MTA to

which email is relayed. You must implement multiple Scanners to perform load

balancing.

Adjusting MX records

When you implement Symantec Mail Security for SMTP in front of a separate

MTA that receives inbound messages, you must to change the DNS mail

exchange (MX) records. The records must point incoming messages to the

system. Symantec Mail Security for SMTP should have a higher priority than

the existing MTA.

However, if you simply list Symantec Mail Security for SMTP as a higher-

weighted MX record in addition to the existing MX record, spammers can look

up the previous MTA’s MX record. This allows them to send spam directly to the

old server, bypassing your spam filtering. To prevent spammers from

circumventing the new spam-filtering servers, you should do one of the

following:

■ Remove the previous MTA’s MX record from DNS.

■ Block off the MTA from the Internet using a firewall.

■ Modify the firewall’s network address translation (NAT) tables to route

external IP addresses to internal non-routable IP addresses. You can then

map from the old server to Symantec Mail Security for SMTP.

■ When naming Symantec Mail Security for SMTP, ensure that the name you

choose does not imply its function. For example, antispam.yourdomain.com,

symantec.yourdomain.com, or antivirus.yourdomain.com are not good

choices.

Adjusting RAM and MySQL threads

The Control Center is a combination of Tomcat and MySQL applications. Tomcat

provides the Web-based interface, and MySQL is the database storage. Their

default configuration performs well in installations with a single Scanner and

low volume email traffic. In installations where multiple Scanners or large

amounts of spam are processed, increasing the amount of RAM allocated to

20 Planning your deployment

Deployment models

Tomcat and increasing the number of listener and consumer threads in MySQL

improves performance.

Deployment models

You can deploy Symantec Mail Security for SMTP in the following ways:

■ Basic gateway deployment

■ Multi-tier gateway deployment

■ Post-gateway deployment

Basic gateway deployment

This is the simplest deployment model. Symantec Mail Security for SMTP

resides at the outermost gateway layer, processing inbound and outbound mail,

providing Secure Email Services, and relaying mail to other relay layers or to the

user-facing mail server layer.

On all configured server computers, port 443 must be configured to permit

outbound connections to Symantec to download content updates.

The following figure shows Symantec Mail Security for SMTP deployed at the

gateway, behind a firewall.

Figure 2-1 Basic gateway deployment

Advantages

■ Because spam emanates from the outside world, the gateway is the logical

and effective place to deploy Symantec Mail Security for SMTP.

■ When you deploy the system closer to the gateway, you can minimize mail

processing and storage requirements as well as network bandwidth via

Email Firewall filtering.

Page is loading ...

Symantec Mail Security for SMTP Planning Manual

Brand: Symantec

Model: Mail Security for SMTP

Category: Operating systems

Type: Planning Manual

This manual is also suitable for

10765539 - Mail Security For SMTP

Download PDF

report

Symantec Mail Security for SMTP Planning Manual

This manual is also suitable for

Symantec Mail Security for SMTP Planning Manual

Related papers

Other documents