Fortinet Fortigate-5000 series Administration Manual page 278

Configuring a protection profile
278
The following options are available for spam filtering through the protection profile.
FortiGuard-Antispam IP address
check
URL check Enable or disable the FortiGuard-Antispam spam
E-mail
checksum
check
Spam
submission
IP address BWL check Black/white list check. Enable or disable the checking incoming
IP addresses against the configured spam filter IP address list.
(SMTP only.)
IP address BWL check drop-down list: Select which IP
address black/white list will be used with this protection profile.
HELO DNS lookup Enable or disable looking up the source domain name (from the
SMTP HELO command) in the Domain Name Server.
E-mail address BWL Enable or disable checking incoming email addresses against the
configured spam filter email address list.
check
E-mail address BWL check drop-down list: Select which email
address black/white list will be used with this protection profile.
Return e-mail DNS Enable or disable checking that the domain specified in the reply-
to or from address has an A or MX record.
check
Banned word check Enable or disable checking source email against the configured
spam filter banned word list.
Banned word check drop-down list: Select which banned word
list will be used with this protection profile.
Threshold: If the combined scores of the banned word patterns
appearing in an email message exceed the threshold value, the
message will be processed according to the Spam Action setting.
See
details.
Enable or disable the FortiGuard-Antispam™
filtering IP address blacklist. FortiGuard-Antispam
extracts the SMTP mail server source address and
sends the IP address to a FortiGuard-Antispam
server to see if this IP address matches the list of
known spammers. If the IP address is found,
FortiGuard-Antispam terminates the session. If
FortiGuard-Antispam does not find a match, the
mail server sends the email to the recipient.
See "FortiGuard-Antispam Service" on page 162
more information about this service.
filtering URL blacklist. FortiGuard-Antispam checks
the body of email messages to extract any URL
links. These URL links are sent to a FortiGuard-
Antispam server to see if any are listed. Spam
messages often contain URL links to
advertisements (also called spamvertizing). If a
URL match is found, FortiGuard-Antispam
terminates the session. If FortiGuard-Antispam
does not find a match, the mail server sends the
email to the recipient.
See "FortiGuard-Antispam Service" on page 162
more information about this service.
Enable or disable the FortiGuard-Antispam e-mail
message checksum blacklist. If enabled, this filter
calculates the checksum of an email message and
sends this checksum to the FortiGuard servers to
determine if the checksum is in the blacklist. The
FortiGate unit then passes or marks/blocks the
email message according to the server response.
When enabled, all e-mail messages marked as
spam have a link added to the message body. If an
email message is not spam, simply click the link in
the message to inform FortiGuard of the false
positive.
"Viewing the antispam banned word list" on page 385
FortiGate Version 3.0 MR4 Administration Guide
Firewall Protection Profile
for
for
for
01-30004-0203-20070102