AntiSpam and Email Security

[gemechisd]

We have check point gateway with 7000 series. And last month we have updated our license. So, we want to use Anti Spam & Email Security feature. How can we enable that? How can we configure any rules for that associated blade? If there are things we need to know before enabling that feature?

[Lesley]

Start with the relevant documentation: 

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_ThreatPrevention_AdminGuide/...

Here a FAQ regarding MTA:

https://support.checkpoint.com/results/sk/sk108553

https://support.checkpoint.com/results/sk/sk109699

Why you might need MTA:

https://support.checkpoint.com/results/sk/sk98973

Not sure you run VSX but this is not supported:

https://support.checkpoint.com/results/sk/sk79700

[gemechis]

@Lesley thanks for the detail explanation.

Is enabling MTA a must to use Anti spam and email security? And what are both the advantages and disadvantages of MTA enabling on a maestro? 

[PhoneBoy]

If email is transported with TLS, an MTA is required as we won't be able to see the mail content otherwise.

[Wolfgang]

@gemechis MTA is not required for AntiSpam-Blade. Without MTA you have features like BlackList block, IP reputation and content spam check for messages they are not sent encrypted (mentioned by @PhoneBoy )

ThreatExtraction (SandBoxing, remove malicious content from file-attachments or convert to pdf) requires MTA.

As a hint....All features they must be configured in the old SmartDasboard can be used without MTA. All other configuration in the mail tab of ThreatPrevention-Profile needs MTA enabled.

[gemechis]

@Wolfgang Thanks for the reply.

Today, I have tried to configure "Configuring a Content Anti-Spam Policy", "Configuring an IP Reputation Policy", "Configuring a Block List". From this 3, IP retutation is working. But we tried to block using domains but emails are arriving at our mailbox.

What could be the issue. I have not enabled MTA, 

Any help on this 

[gemechis]

@Lesley @PhoneBoy @Wolfgang 

I have checked all MTA articles and found there are three (3) deployment methods for it.
1. Check Point MTA as the organization MX record
2. Check Point MTA as an internal MTA
3. Check Point MTA in BCC Mode

My question is that if we configure using option 3 which is "Check Point MTA in BCC Mode" How does the mail extraction and emulation going to be done? 

[PhoneBoy]

In BCC mode, a copy of the email is sent to emulation, but it is not prevented from reaching the end users inbox.
For full prevention, you need to deploy it with one of the other methods.

[gemechis]

Hi @PhoneBoy 

Thanks for the reply.

Today, I have tried to configure "Configuring a Content Anti-Spam Policy", "Configuring an IP Reputation Policy", "Configuring a Block List". From this 3, IP retutation is working. But we tried to block using domains but emails are arriving at our mailbox.

What could be the issue. I have not enabled MTA, 

[PhoneBoy]

If SMTP is sent via TLS, then you will not be able to block by domain as there is no way to see what domains are involved in the email.
In this case, you will need to use MTA mode.

[gemechis]

@PhoneBoy okay.

So,
      1. Which one's can I configure without enabling MTA?
      2. If enabling MTA is a must to, which mode do you recommend considering resource utilization.

[Wolfgang]

Dear @gemechis all depends on what do you want to achieve...

You can configure to block a mail domain, but as @PhoneBoy mentioned this wil only work if the mail arrives without TLS. You can configure to block a mail by IP-address, this will be blocked with TLS or without.

The content of a mail-message can't be checked if send via TLS, you have to decrypt these messages to do any content scan.

You can enable MTA and all features of "Configuring a Content Anti-Spam Policy", "Configuring an IP Reputation Policy", "Configuring a Block List" will work with TLS and without.

If you want to get the most valuable, you have to enable MTA, the Content Anti-Spam Policy,   the IP Reputation Policy, the Block List and the ThreatExtraction features.

[gemechis]

@Wolfgang thanks.

Is there any method in which i can enable MTA without changing my current architecture. To see the impacts 

[Wolfgang]

I believe not. If you enable an additional MTA in the mailflow between Sender and recipients there is always an impact. If everything is configured correct the mail messages will be delivered. But it‘s the behavior of a MTA accepting the messages, doing some checks and then send them to the next hop.

[gemechis]

Okay. So, to see all the impact on the gateway, I will configure MTA with a BCC mode and check the impact. 

[gemechis]

@Wolfgang 

I am planning to configure MTA with third option of deployment of "MTA in Backward Compatibility Mode".  In that case what's the need of importing our mailboxes certificate to the checkpoint security gateway? 

Also, who is responsible for decrypting the incoming mail? Is that a mailbox or security gateway?

[PhoneBoy]

You have to have a certificate for the MTA on the Security Gateway to terminate SMTP over TLS.
This handles the transport layer encryption.
The message will be queued/scanned on the gateway and forwarded to the configured next-hop MTA.

Note content security can't be done on the message if it's encrypted (e.g. with S/MIME), but the headers should be fully visible.

[Wolfgang]

@gemechisd There are not much configuration options. You have to enable the blade and most of the things are configured via the old SmartDashboard. There you can enable AntiSpam- and IPreputation-level  and configure exceptions. If you enable the MTA on the gateway you can use your TP profile to check messages for viruses and emulate files in TP environment. 
AntiSpam and IP-reputation both have really good results but configuration options are very limited. No quarantine, limited exceptions, no address checking in the internal mail environment……

[gemechis]

@Wolfgang Thanks for the explanation. But If don't want to enable MTA is AntiSpam and IP-reputation the only option working without MTA? 

Who is responsible for analysing attachments?

[gemechis]

We have a check point deployment in our environment and we need to enable the "Anti Spam and Email Security" Blade. And we need to configure 

• Content Anti-Spam Policy
• IP Reputation Policy
• Block List
• Anti-Spam SMTP
• Anti-Spam POP3

After enabling the blade, I have configured the IP Reputation and Block list. And the IP Reputation worked but the block list is not. what could be enabled to see the block list working in our environment. 

[Chris_Atkinson]

What have you configured in the block list ip/domain/email?

Is anti-spam seeing SMTP TLS traffic (sk98973)?

[gemechis]

Yes. It's encrypted. 

[the_rock]

Would you mind send us some screenshots how this is configured? Just blur out the sensitive data.

Andy

[gemechis]

@the_rock 

Below you can find the screenshots.

[the_rock]

Looks right. I would confirm with TAC, but what Phoneboy said seems most logical.

Andy

[gemechis]

@the_rock 

Ok. one thing i need to clarify. What are the possible configurations I can do with out enabling MTA?

[the_rock]

@gemechisd 

Sorry for the delay mate, just saw this message, apologies. I really cant give you good suggestion on that, as Im not sure. I would verify with TAC.

Andy

[gemechis]

@the_rock 

will wait for the response