AntiSpam and Email Security

[gemechisd]

We have check point gateway with 7000 series. And last month we have updated our license. So, we want to use Anti Spam & Email Security feature. How can we enable that? How can we configure any rules for that associated blade? If there are things we need to know before enabling that feature?

[Lesley]

Start with the relevant documentation: 

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_ThreatPrevention_AdminGuide/...

Here a FAQ regarding MTA:

https://support.checkpoint.com/results/sk/sk108553

https://support.checkpoint.com/results/sk/sk109699

Why you might need MTA:

https://support.checkpoint.com/results/sk/sk98973

Not sure you run VSX but this is not supported:

https://support.checkpoint.com/results/sk/sk79700

[gemechis]

@Lesley thanks for the detail explanation.

Is enabling MTA a must to use Anti spam and email security? And what are both the advantages and disadvantages of MTA enabling on a maestro? 

[PhoneBoy]

If email is transported with TLS, an MTA is required as we won't be able to see the mail content otherwise.

[Wolfgang]

@gemechis MTA is not required for AntiSpam-Blade. Without MTA you have features like BlackList block, IP reputation and content spam check for messages they are not sent encrypted (mentioned by @PhoneBoy )

ThreatExtraction (SandBoxing, remove malicious content from file-attachments or convert to pdf) requires MTA.

As a hint....All features they must be configured in the old SmartDasboard can be used without MTA. All other configuration in the mail tab of ThreatPrevention-Profile needs MTA enabled.

[Wolfgang]

@gemechisd There are not much configuration options. You have to enable the blade and most of the things are configured via the old SmartDashboard. There you can enable AntiSpam- and IPreputation-level  and configure exceptions. If you enable the MTA on the gateway you can use your TP profile to check messages for viruses and emulate files in TP environment. 
AntiSpam and IP-reputation both have really good results but configuration options are very limited. No quarantine, limited exceptions, no address checking in the internal mail environment……

[gemechis]

@Wolfgang Thanks for the explanation. But If don't want to enable MTA is AntiSpam and IP-reputation the only option working without MTA? 

Who is responsible for analysing attachments?