Symantec 10490452 - Mail Security 8220 Instruction Manual

Symantec Mail Security for
SMTP
Administration Guide

Symantec Mail Security for SMTP
Administration Guide
The software described in this book is furnished under a license agreement and
may be used only in accordance with the terms of the agreement.
April 27, 2006
Copyright notice
Copyright © 1998-2006 Symantec Corporation. All rights reserved. Symantec, the
Symantec logo, Brightmail, LiveUpdate, SESA, and Norton AntiVirus are U.S. registered
trademarks or registered trademarks of Symantec Corporation or its affiliates in other
countries. Other names may be trademarks of their respective owners.
Symantec Mail Security for SMTP 5.0 is protected under U.S. Patent Nos. 6,052,709;
5,999,932; and 6,654,787.
The product described in this document is distributed under licenses restricting its use,
copying, distribution, and decompilation/reverse engineering. No part of this document
may be reproduced in any form by any means without prior written authorization of
Symantec Corporation and its licensors, if any.
THE DOCUMENTATION IS PROVIDED “AS IS” AND ALL EXPRESS OR IMPLIED
CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED
WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-
INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH
DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL
NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION
WITH THE FURNISHING PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE
INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE
WITHOUT NOTICE.
The Licensed Software and Documentation are deemed to be “commercial computer
software” and “commercial computer software documentation” as defined in FAR
Sections 12.212 and DFARS Section 227.7202.
Symantec Corporation
20330 Stevens Creek Blvd.
Cupertino, CA 95014
http://www.symantec.com
Printed in the United States of America.
10987654321

Technical support
As part of Symantec Security Response, the Symantec global Technical Support
group maintains support centers throughout the world. The Technical Support
group’s primary role is to respond to specific questions on product feature/
function, installation, and configuration, as well as to author content for our
Web-accessible Knowledge Base. The Technical Support group works
collaboratively with the other functional areas within Symantec to answer your
questions in a timely fashion. For example, the Technical Support group works
with Product Engineering as well as Symantec Security Response to provide
Alerting Services and Virus Definition Updates for virus outbreaks and security
alerts.
Symantec technical support offerings include:
■A range of support options that give you the flexibility to select the right
amount of service for any size organization
■Telephone and Web support components that provide rapid response and
up-to-the-minute information
■Upgrade insurance that delivers automatic software upgrade protection
■Content Updates for virus definitions and security signatures that ensure
the highest level of protection
■Global support from Symantec Security Response experts, which is
available 24 hours a day, 7 days a week worldwide in a variety of languages
for those customers enrolled in the Platinum Support Program
■Advanced features, such as the Symantec Alerting Service and Technical
Account Manager role, offer enhanced response and proactive security
support
Please visit our Web site for current information on Support Programs. The
specific features available may vary based on the level of support purchased and
the specific product that you are using.
To receive the latest product information by email, go to:
http://www.symantec.com/techsupp/bulletin/enterprise.html
and join our support bulletin mailing list.
Licensing and registration
If the product that you are implementing requires registration and/or a license
key, the fastest and easiest way to register your service is to access the
Symantec licensing and registration site at www.symantec.com/certificate.
Alternatively, you may go to www.symantec.com/techsupp/ent/enterprise.html,
select the product that you wish to register, and from the Product Home Page,
select the Licensing and Registration link.

Contacting Technical Support
Customers with a current support agreement may contact the Technical
Support group via phone or online at http://www.symantec.com/techsupp/
enterprise/ .
Customers with Platinum support agreements may contact Platinum Technical
Support via the Platinum Web site at http://www-secure.symantec.com/
platinum/ .
When contacting the Technical Support group, please have the following:
■Product release level
■Hardware information
■Available memory, disk space, NIC information
■Operating system
■Version and patch level
■Network topology
■Router, gateway, and IP address information
■Problem description
■Error messages/log files
■Troubleshooting performed prior to contacting Symantec
■Recent software configuration changes and/or network changes
Customer Service
To contact Enterprise Customer Service online, go to www.symantec.com, select
the appropriate Global Site for your country, then choose Service and Support.
Customer Service is available to assist with the following types of issues:
■Questions regarding product licensing or serialization
■Product registration updates such as address or name changes
■General product information (features, language availability, local dealers)
■Latest information on product updates and upgrades
■Information on upgrade insurance and maintenance contracts
■Information on Symantec Value License Program
■Advice on Symantec's technical support options
■Nontechnical presales questions
■Missing or defective CD-ROMs or manuals

Contents
Chapter 1 About Symantec Mail Security for SMTP
Key features .......................................................................................................... 11
Functional overview ............................................................................................ 12
Architecture .......................................................................................................... 13
Where to get more information .........................................................................14
Chapter 2 Configuring system settings
Configuring certificate settings ........................................................................ 17
Configuring host (Scanner) settings ................................................................. 20
Working with the Services page ................................................................20
HTTP proxies ................................................................................................ 21
SMTP Scanner settings ...............................................................................22
Advanced SMTP settings ............................................................................ 25
Configuring internal mail hosts ................................................................28
Testing Scanners ................................................................................................. 28
Configuring LDAP settings ................................................................................. 29
Replicating data to Scanners .............................................................................37
Starting and stopping replication ............................................................. 38
Replication status information .................................................................. 38
Troubleshooting replication ...................................................................... 39
Configuring Control Center settings ................................................................ 40
Control Center administration .................................................................. 41
Control Center certificate ...........................................................................42
Configuring, enabling and scheduling Scanner replication .................. 42
SMTP host ..................................................................................................... 44
System locale ................................................................................................ 44
Chapter 3 Configuring email settings
Configuring address masquerading .................................................................. 45
Importing masqueraded entries ................................................................ 46
Configuring aliases .............................................................................................. 47
Importing aliases ......................................................................................... 49
Configuring local domains ................................................................................. 50
Importing local domains and email addresses ........................................51

6Contents
Understanding spam settings ............................................................................ 51
Configuring suspected spam ...................................................................... 52
Choosing language identification type ..................................................... 52
Software acceleration ................................................................................. 53
Configuring spam settings ......................................................................... 53
Configuring virus settings .................................................................................. 54
Configuring LiveUpdate ............................................................................. 54
Excluding files from virus scanning ......................................................... 55
Configuring general settings ..................................................................... 56
Configuring invalid recipient handling ............................................................ 56
Configuring scanning settings .......................................................................... 57
Configuring container settings .................................................................. 57
Configuring content filtering settings ..................................................... 58
Chapter 4 Configuring email filtering
About email filtering ........................................................................................... 61
Notes on filtering actions ........................................................................... 66
Multiple actions ........................................................................................... 67
Multiple policies ........................................................................................... 69
Security risks ................................................................................................ 70
About precedence ........................................................................................ 71
Creating groups and adding members ............................................................. 72
Assigning filter policies to a group ................................................................... 75
Selecting virus policies for a group ........................................................... 75
Selecting spam policies for a group .......................................................... 77
Selecting compliance policies for a group ............................................... 78
Enabling and disabling end user settings ................................................ 79
Allowing or blocking email based on language ....................................... 80
Managing Group Policies .................................................................................... 81
Creating virus, spam, and compliance filter policies ..................................... 82
Creating virus policies ................................................................................ 83
Creating spam policies ................................................................................ 85
Creating compliance policies ..................................................................... 86
Managing Email Firewall policies ..................................................................... 93
Configuring attack recognition ................................................................. 94
Configuring sender groups ......................................................................... 95
Configuring Sender Authentication ...............................................................105
Managing policy resources ..............................................................................106
Annotating messages ................................................................................106
Archiving messages ...................................................................................109
Configuring attachment lists ...................................................................110
Configuring dictionaries ...........................................................................112
Adding and editing notifications .............................................................114

7Contents
Chapter 5 Working with Spam Quarantine
About Spam Quarantine ...................................................................................117
Delivering messages to Spam Quarantine .....................................................117
Working with messages in Spam Quarantine for administrators .............118
Accessing Spam Quarantine ....................................................................118
Checking for new Spam Quarantine messages .....................................118
Administrator message list page .............................................................118
Administrator message details page .......................................................121
Searching messages ...................................................................................123
Configuring Spam Quarantine .........................................................................126
Delivering messages to Spam Quarantine from the Scanner .............126
Configuring Spam Quarantine port for incoming email .....................127
Configuring Spam Quarantine for administrator-only access ...........128
Configuring the Delete Unresolved Email setting ................................128
Configuring the login help .......................................................................128
Configuring recipients for misidentified messages .............................129
Configuring the user and distribution list notification digests ..........130
Configuring the Spam Quarantine Expunger ........................................135
Specifying Spam Quarantine message and size thresholds ................136
Troubleshooting Spam Quarantine ........................................................137
Chapter 6 Working with Suspect Virus Quarantine
About Suspect Virus Quarantine .....................................................................143
Accessing Suspect Virus Quarantine ..............................................................143
Checking for new Suspect Virus Quarantine messages .......................144
Suspect Virus Quarantine messages page .............................................144
Searching messages ...................................................................................146
Configuring Suspect Virus Quarantine ..........................................................148
Configuring Suspect Virus Quarantine port for incoming email .......148
Configuring the size for Suspect Virus Quarantine .............................148
Chapter 7 Testing Symantec Mail Security for SMTP
Verifying normal delivery ................................................................................151
Verifying spam filtering ...................................................................................151
Testing antivirus filtering ................................................................................152
Verifying filtering to the Spam Quarantine ..................................................153
Chapter 8 Configuring alerts and logs
Configuring alerts ..............................................................................................155
Viewing logs ........................................................................................................157
Configuring logs .................................................................................................159

8Contents
Chapter 9 Working with reports
About reports .....................................................................................................163
Choosing a report ..............................................................................................164
About charts and tables ....................................................................................172
Selecting report data to track ..........................................................................172
Setting the retention period for report data .................................................173
Running reports .................................................................................................173
Saving and editing Favorite Reports ..............................................................174
Running and deleting favorite reports ...........................................................175
Troubleshooting report generation ................................................................175
No data available for the report type specified .....................................175
Sender HELO domain or IP connection shows gateway
information .........................................................................................176
Reports presented in local time of Control Center ...............................176
By default, data are saved for one week .................................................176
Processed message count recorded per message, not per
recipient ..............................................................................................176
Recipient count equals message count ...................................................177
Deferred or rejected messages are not counted as received ...............177
Reports limited to 1,000 rows ..................................................................177
Printing, saving, and emailing reports ...........................................................177
Scheduling reports to be emailed ....................................................................178
Chapter 10 Administering the system
Getting status information ..............................................................................181
Overview of system information .............................................................182
Message status ...........................................................................................182
Host status ..................................................................................................186
LDAP synchronization ..............................................................................187
Log details ...................................................................................................188
Scanner replication ...................................................................................188
Version Information ..................................................................................188
Managing Scanners ...........................................................................................188
Editing Scanners ........................................................................................189
Enabling and disabling Scanners ............................................................189
Deleting Scanners ......................................................................................190
Administering the system through the Control Center ..............................191
Managing system administrators ...........................................................191
Managing software licenses .....................................................................192

9Contents
Administering the Control Center ..................................................................193
Starting and stopping the Control Center .............................................193
Checking the Control Center error log ...................................................194
Increasing the amount of information in BrightmailLog.log .............195
Starting and stopping UNIX and Windows services ....................................196
Starting and stopping Windows services ...............................................196
Starting and stopping UNIX services .....................................................198
Periodic system maintenance ..........................................................................198
Backing up logs data ..................................................................................198
Backing up the Spam and Virus Quarantine databases .......................199
Maintaining adequate disk space ............................................................200
Appendix A Feature Cross-Reference
New features for all users .................................................................................202
Changes for Symantec Mail Security for SMTP users .................................203
New feature names ....................................................................................204
Discontinued features ...............................................................................204
Changes for Symantec Brightmail Antispam users .....................................205
About email filtering and message handling options ..................................206
Appendix B Spam foldering and the Symantec Outlook Spam Plug-in
About foldering and the plug-in ......................................................................209
Installing the Symantec Outlook Spam Plug-in ............................................210
Usage scenarios ..........................................................................................210
End user experience ..................................................................................210
Software requirements .............................................................................212
Configuring automatic spam foldering ..........................................................217
Configuring the Symantec Spam Folder Agent for Exchange ............217
Configuring the Symantec Spam Folder Agent for Domino ...............218
Enabling automatic spam foldering ................................................................221
Enabling language identification ....................................................................222
Appendix C Integrating Symantec Mail Security with Symantec
Security Information Manager
About Symantec Security Information Manager ..........................................223
Interpreting events in the Information Manager .........................................224
Configuring data sources ..........................................................................225
Firewall events that are sent to the Information Manager .................226
Definition Update events that are sent to the Information
Manager ...............................................................................................226
Message events that are sent to the Information Manager ................227
Administration events that are sent to the Information Manager ....228

10 Contents
Appendix D Editing antivirus notification messages
Modifying notification files .............................................................................231
Changing the notification file character set ..........................................232
Editing messages in the notification file ................................................232
Notification file contents .................................................................................233
Glossary
Index