在 SRX 系列设备上配置 SMTP 电子邮件策略
与定义操作允许或操作阻止语句的文件扫描策略不同，使用 SMTP 电子邮件管理，要执行的操作在 “配置>电子邮件> SMTP ”窗口中定义。所有其他操作都像之前一样使用 CLI 命令定义。
下面显示的是在配置文件 profile2中处理的电子邮件附件的示例。
user@host# show services advanced-anti-malware
...
policy policy1 {
http {
inspection-profile default_profile; # Global profile
action permit;
}
smtp {
inspection-profile profile2; # Profile2 applies to SMTP email
notification {
log;
}
}
verdict-threshold 8; # Globally, a score of 8 and above indicate possible malware
fallback-options {
action permit;
notification {
log;
}
}
default-notification {
log;
}
whitelist-notification {
log;
}
blacklist-notification {
log;
}
fallback-options {
action permit; # default is permit and no log.
notification log;
}
}
...
在上述示例中，电子邮件配置文件（profile2）如下所示：
user@host> show services advanced-anti-malware profile
Advanced anti-malware inspection profile:
Profile Name: profile2
version: 1443769434
disabled_file_types:
{
application/x-pdfa: [pdfa],
application/pdf: [pdfa],
application/mbox: []
},
disabled_categories: [java, script, documents, code],
category_thresholds: [
{
category: executable,
min_size: 512,
max_size: 1048576
},
{
category: library,
min_size: 4096,
max_size: 1048576
}]
防火墙策略与之前类似。AAMW 策略放置在不信任区域的信任中。.请参阅以下示例。
user@host# show security policies from-zone trust to-zone untrust {
policy p1 {
match {
source-address any;
destination-address any;
application any;
}
then {
permit {
application-services {
advanced-anti-malware-policy policy1;
ssl-proxy {
profile-name ssl-proxy1;
}
}
}
}
}
}
下面显示的是另一个使用 show services advanced-anti-malware policy CLI 命令的示例。在此示例中，如果发现电子邮件附件中包含恶意软件，将隔离电子邮件。判决分数为 8 及以上表示存在恶意软件。
user@root> show services advanced-anti-malware policy policy1
Advanced-anti-malware configuration:
Policy Name: policy1
Default-notification : No Log
Whitelist-notification: Log
Blacklist-notification: Log
Fallback options:
Action: permit
Notification: Log
Inspection-profile: profile2
Applications: HTTP
Verdict-threshold: 8
Action: block
Notification: Log
Protocol: SMTP
Verdict-threshold: 8
Action: User-Defined-in-Cloud (quarantine)
Notification: Log
Inspection-profile: profile2
您可以选择配置正向和反向代理，分别用于服务器和客户端保护。例如，如果您使用 SMTPS，则可能需要配置反向代理。有关配置反向代理的更多信息，请参阅 在 SRX 系列设备上配置反向代理。
# show services ssl
initiation { # for cloud connection
profile srx_to_sky_tls_profile_name {
trusted-ca sky-secintel-ca;
client-certificate sky-srx-cert;
}
}
proxy {
profile ssl-client-protection { # for forward proxy
root-ca ssl-inspect-ca;
actions {
ignore-server-auth-failure;
log {
all;
}
}
}
profile ssl-server-protection { # for reverse proxy
server-certificate ssl-server-protection;
actions {
log {
all;
}
}
}
}
使用 show services advanced-anti-malware statistics CLI 命令查看有关电子邮件管理的统计信息。
user@host> show services advanced-anti-malware statistics
Advanced-anti-malware session statistics:
Session interested: 3291750
Session ignored: 52173
Session hit blacklist: 0
Session hit whitelist: 0
Total HTTP HTTPS SMTP SMTPS
Session active: 52318 0 0 52318 0
Session blocked: 0 0 0 0 0
Session permitted: 1354706 0 0 1354706 0
Advanced-anti-malware file statistics:
Total HTTP HTTPS SMTP SMTPS
File submission success: 83134 0 0 83134 0
File submission failure: 9679 0 0 9679 0
File submission not needed: 86104 0 0 86104 0
File verdict meets threshold: 65732 0 0 65732 0
File verdict under threshold: 16223 0 0 16223 0
File fallback blocked: 0 0 0 0 0
File fallback permitted: 4512 0 0 4512 0
File hit submission limit: 0 0 0 0 0
Advanced-anti-malware email statistics:
Total SMTP SMTPS
Email processed: 345794 345794 0
Email permitted: 42722 42722 0
Email tag-and-delivered: 0 0 0
Email quarantined: 9830 9830 0
Email fallback blocked: 0 0 0
Email fallback permitted: 29580 29580 0
Email hit whitelist: 0 0 0
Email hit blacklist: 0 0 0
与之前一样，在进行故障排除时，使用 clear services advanced-anti-malware statistics CLI 命令清除上述统计信息。
出于调试目的，您还可以设置 SMTP 跟踪选项。
user@host# set services advanced-anti-malware traceoptions flag smtp
在配置 SMTP 威胁防御策略之前，请确保您已完成以下操作：
在 “配置> 电子邮件> SMTP”窗口中定义要采取的操作（隔离或传递恶意消息）和最终用户电子邮件通知。
（可选）在 “配置>设备配置文件” 窗口中创建一个配置文件，以指示要扫描的电子邮件附件类型。或者，您可以使用默认配置文件。
以下步骤显示最低配置。要使用 CLI 为 SMTP 配置威胁防御策略，