topic Re: AntiSpam and Email Security in General Topics

AntiSpam and Email Security

gemechisd — Thu, 21 Mar 2024 07:15:39 GMT

We have check point gateway with 7000 series. And last month we have updated our license. So, we want to use Anti Spam & Email Security feature. How can we enable that? How can we configure any rules for that associated blade? If there are things we need to know before enabling that feature?

Re: AntiSpam and Email Security

Lesley — Thu, 21 Mar 2024 20:00:53 GMT

Start with the relevant documentation:

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_ThreatPrevention_AdminGuide/Topics-TPG/Using_Anti_Spam_and_Mail.htm?TocPath=Using%20Anti-Spam%20and%20Mail%7CConfiguring%20Anti-Spam%7C_____0#Configuring_Anti-Spam

Here a FAQ regarding MTA:

https://support.checkpoint.com/results/sk/sk108553

https://support.checkpoint.com/results/sk/sk109699

Why you might need MTA:

https://support.checkpoint.com/results/sk/sk98973

Not sure you run VSX but this is not supported:

https://support.checkpoint.com/results/sk/sk79700

Re: AntiSpam and Email Security

Wolfgang — Thu, 21 Mar 2024 20:40:48 GMT

@gemechisd There are not much configuration options. You have to enable the blade and most of the things are configured via the old SmartDashboard. There you can enable AntiSpam- and IPreputation-level and configure exceptions. If you enable the MTA on the gateway you can use your TP profile to check messages for viruses and emulate files in TP environment.
AntiSpam and IP-reputation both have really good results but configuration options are very limited. No quarantine, limited exceptions, no address checking in the internal mail environment……

Re: AntiSpam and Email Security

gemechis — Mon, 03 Feb 2025 11:15:38 GMT

@Lesley thanks for the detail explanation.

Is enabling MTA a must to use Anti spam and email security? And what are both the advantages and disadvantages of MTA enabling on a maestro?

Re: AntiSpam and Email Security

gemechis — Mon, 03 Feb 2025 11:17:30 GMT

@Wolfgang Thanks for the explanation. But If don't want to enable MTA is AntiSpam and IP-reputation the only option working without MTA?

Who is responsible for analysing attachments?

Re: AntiSpam and Email Security

PhoneBoy — Tue, 04 Feb 2025 03:26:01 GMT

If email is transported with TLS, an MTA is required as we won't be able to see the mail content otherwise.

Re: AntiSpam and Email Security

Wolfgang — Thu, 06 Feb 2025 08:07:47 GMT

@gemechis MTA is not required for AntiSpam-Blade. Without MTA you have features like BlackList block, IP reputation and content spam check for messages they are not sent encrypted (mentioned by @PhoneBoy )

ThreatExtraction (SandBoxing, remove malicious content from file-attachments or convert to pdf) requires MTA.

As a hint....All features they must be configured in the old SmartDasboard can be used without MTA. All other configuration in the mail tab of ThreatPrevention-Profile needs MTA enabled.

Re: AntiSpam and Email Security

gemechis — Thu, 20 Feb 2025 07:18:52 GMT

@Lesley @PhoneBoy @Wolfgang

I have checked all MTA articles and found there are three (3) deployment methods for it.
1. Check Point MTA as the organization MX record
2. Check Point MTA as an internal MTA
3. Check Point MTA in BCC Mode

My question is that if we configure using option 3 which is "Check Point MTA in BCC Mode" How does the mail extraction and emulation going to be done?

Re: AntiSpam and Email Security

PhoneBoy — Thu, 20 Feb 2025 13:00:57 GMT

In BCC mode, a copy of the email is sent to emulation, but it is not prevented from reaching the end users inbox.
For full prevention, you need to deploy it with one of the other methods.

Re: AntiSpam and Email Security

gemechis — Fri, 28 Feb 2025 08:41:39 GMT

@Wolfgang Thanks for the reply.

Today, I have tried to configure "Configuring a Content Anti-Spam Policy", "Configuring an IP Reputation Policy", "Configuring a Block List". From this 3, IP retutation is working. But we tried to block using domains but emails are arriving at our mailbox.

What could be the issue. I have not enabled MTA,

Any help on this

Re: AntiSpam and Email Security

gemechis — Fri, 28 Feb 2025 08:47:57 GMT

Hi @PhoneBoy

Thanks for the reply.

Today, I have tried to configure "Configuring a Content Anti-Spam Policy", "Configuring an IP Reputation Policy", "Configuring a Block List". From this 3, IP retutation is working. But we tried to block using domains but emails are arriving at our mailbox.

What could be the issue. I have not enabled MTA,

Anti Spam and Email Security Blade

gemechis — Fri, 28 Feb 2025 13:42:06 GMT

We have a check point deployment in our environment and we need to enable the "Anti Spam and Email Security" Blade. And we need to configure

Content Anti-Spam Policy
IP Reputation Policy
Block List
Anti-Spam SMTP
Anti-Spam POP3

After enabling the blade, I have configured the IP Reputation and Block list. And the IP Reputation worked but the block list is not. what could be enabled to see the block list working in our environment.

Re: Anti Spam and Email Security Blade

Chris_Atkinson — Fri, 28 Feb 2025 14:39:28 GMT

What have you configured in the block list ip/domain/email?

Is anti-spam seeing SMTP TLS traffic (sk98973)?

Re: Anti Spam and Email Security Blade

the_rock — Fri, 28 Feb 2025 14:42:19 GMT

Would you mind send us some screenshots how this is configured? Just blur out the sensitive data.

Andy

Re: AntiSpam and Email Security

PhoneBoy — Fri, 28 Feb 2025 16:56:47 GMT

If SMTP is sent via TLS, then you will not be able to block by domain as there is no way to see what domains are involved in the email.
In this case, you will need to use MTA mode.

Re: Anti Spam and Email Security Blade

gemechis — Sat, 01 Mar 2025 08:24:56 GMT

Yes. It's encrypted.

Re: Anti Spam and Email Security Blade

gemechis — Sat, 01 Mar 2025 08:30:44 GMT

@the_rock

Below you can find the screenshots.

Re: Anti Spam and Email Security Blade

the_rock — Sat, 01 Mar 2025 11:20:34 GMT

Looks right. I would confirm with TAC, but what Phoneboy said seems most logical.

Andy

Re: Anti Spam and Email Security Blade

gemechis — Mon, 03 Mar 2025 08:07:43 GMT

@the_rock

Ok. one thing i need to clarify. What are the possible configurations I can do with out enabling MTA?

Re: AntiSpam and Email Security

gemechis — Mon, 03 Mar 2025 10:55:46 GMT

@PhoneBoy okay.

So,
1. Which one's can I configure without enabling MTA?
2. If enabling MTA is a must to, which mode do you recommend considering resource utilization.