Technical Note. FortiMail Best Practices Version 3.0 MR4.

Transcription

1 Technical Note FortiMail Best Practices Version 3.0 MR4

2 FortiMail Best Practices Technical Note Version 3.0 MR4 October 29, Copyright 2007 Fortinet, Inc. All rights reserved. No part of this publication including text, examples, diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of Fortinet, Inc. Trademarks Dynamic Threat Prevention System (DTPS), APSecure, FortiASIC, FortiBIOS, FortiBridge, FortiClient, FortiGate, FortiGate Unified Threat Management System, FortiGuard, FortiGuard-Antispam, FortiGuard- Antivirus, FortiGuard-Intrusion, FortiGuard-Web, FortiLog, FortiAnalyzer, FortiManager, Fortinet, FortiOS, FortiPartner, FortiProtect, FortiReporter, FortiResponse, FortiShield, FortiVoIP, and FortiWiFi are trademarks of Fortinet, Inc. in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners.

3 Contents Contents Introduction... 5 About the FortiMail Secure Messaging Platform... 5 About this document... 5 Fortinet documentation... 5 Fortinet Tools and Documentation CD... 5 Fortinet Knowledge Center... 5 Comments on Fortinet technical documentation... 6 Customer service and technical support... 6 FortiMail best practices... 7 Operating modes... 7 Gateway mode... 7 Transparent mode... 7 Server mode... 7 System... 7 High availability... 8 Antivirus and spam definition updates... 9 Mail settings... 9 Antispam settings Policies Maintenance Performance tuning Black and white lists Network topology FortiMail transparent mode

4 Contents

5 Introduction About the FortiMail Secure Messaging Platform Introduction This chapter introduces you to FortiMail Best Practices and the following topics: About the FortiMail Secure Messaging Platform About this document Fortinet documentation Customer service and technical support About the FortiMail Secure Messaging Platform The FortiMail unit is an integrated hardware and software solution that provides powerful and flexible logging and reporting, antispam, antivirus, and archiving capabilities to incoming and outgoing traffic. The FortiMail unit has reliable and high performance features for detecting and blocking spam messages and malicious attachments. Built on Fortinet s FortiOS, the FortiMail antivirus technology extends full content inspection capabilities to detect the most advanced threats. About this document This document is a collection of operating guidelines to ensure the most effective and secure operation of your FortiMail unit. Fortinet documentation The most up-to-date publications and previous releases of Fortinet product documentation are available from the Fortinet Technical Documentation web site at Fortinet Tools and Documentation CD Fortinet Knowledge Center All Fortinet documentation is available from the Fortinet Tools and Documentation CD shipped with your Fortinet product. The documents on this CD are current at shipping time. For up-to-date versions of Fortinet documentation see the Fortinet Technical Documentation web site at Additional Fortinet technical documentation is available from the Fortinet Knowledge Center. The knowledge center contains troubleshooting and how-to articles, FAQs, technical notes, and more. Visit the Fortinet Knowledge Center at

6 Customer service and technical support Introduction Comments on Fortinet technical documentation Please send information about any errors or omissions in this document, or any Fortinet technical documentation, to Customer service and technical support Fortinet Technical Support provides services designed to make sure that your Fortinet systems install quickly, configure easily, and operate reliably in your network. Please visit the Fortinet Technical Support web site at to learn about the technical support services that Fortinet provides

7 FortiMail best practices Operating modes FortiMail best practices This chapter is a collection of guidelines to ensure the most secure and reliable operation of FortiMail units in a customer environment. It is updated periodically as new issues are identified. Operating modes Gateway mode Transparent mode Server mode The FortiMail unit has three operating modes, each for a specific purpose. Choose gateway mode when you do not want your mail servers to be visible to users for security reasons. Make sure modify your mail routing policy to route incoming to the FortiMail unit to be scanned. Use transparent mode when a network is complex and does not allow for changes in the IP addressing scheme. Select server mode if you need a secure and reliable server with integrated advanced antispam and antivirus capabilities. System Restrict FortiMail management access to trusted networks. For tighter security, use the trusted hosts feature to restrict FortiMail management access to specific IP addresses. Trusted hosts are set in System > Config > Admin. Allow management access to only the FortiMail interfaces requiring it. Management access can be modified by going to System > Network > Interface, selecting the Modify icon for the interface to be configured, and selecting the required access types. Create additional system and domain administrators with limited access rights for less-demanding management tasks. Administrator passwords should be at least six characters long and use both numbers and letters. Admin passwords can be changed by going to System > Config > Admin and selecting the Change Password icon for the login to be modified. Do not increase the administrator idle time-out from the default of five minutes. The admin idle time-out is set in System > Config > Options. Make sure that the system time and time zone are correct. The system time and time zone are set in System > Config > Time

8 High availability FortiMail best practices If your FortiMail unit has an LCD panel, restrict access to the control buttons and LCD by requiring a PIN. The LCD PIN is set in System > Config > Options. Use a different host name for each FortiMail unit when managing multiple FortiMail units of the same model or when configuring an HA cluster. The host name is set in Mail Settings > Settings > Settings. High availability Isolate HA interfaces from your user networks. Heartbeat and synchronization packets contain sensitive configuration information and can consume considerable network bandwidth. For an active-passive or a config only HA group consisting of only two FortiMail units, directly connect the HA interfaces using a crossover cable. For a config only HA group consisting of more than two FortiMail units, connect the HA interfaces to a switch and do not connect this switch to your user networks. Use FortiMail active-passive HA to provide failover protection so that if your primary FortiMail unit fails, the backup FortiMail unit can continue processing with only a minor interruption to your traffic. Use config only HA if you want to create a mail server farm for a large organization. You can also install a FortiMail config only HA group behind a load balancer. The load balancer can balance the mail processing load to all of the FortiMail units in the config only HA group, improving mail processing capacity. Make sure the HA heartbeat connections are always maintained between FortiMail units in an HA group. You can use the primary heartbeat interface, secondary heartbeat interface, and the remote services tracking to detect the HA failovers. If HA heartbeat communication is interrupted and no remote services is detected, the backup unit will assume that the primary unit has failed. As a result both FortiMail units may be operating as primary (master) units. You can return the HA group to normal operation by re-connecting the HA heartbeat interfaces. Then log into the web-based manager of the FortiMail unit that is configured to be the backup unit, go to System > HA > Status, and select Click HERE to restore configured operating mode. You must license all of the FortiMail units in the HA group for the FortiGuard Antispam and Antivirus services. If you only license the primary unit in an active-passive HA group, after a failover the backup unit will not be able to connect to the FortiGuard Antispam service. Also, antivirus engine and antivirus definition versions are not synchronized between the primary and backup units. Usually you should configure HA to synchronize the system mail directory and the user home directory so that no messages in these directories are lost when a failover occurs. Synchronizing or backing up the FortiMail MTA spool directories is not recommended. Because the content of the MTA spool directories is very dynamic, synchronizing MTA spool directories between FortiMail units may not be effective and may use a lot of bandwidth. Also, FortiMail HA includes a mechanism for synchronizing the MTA spool directories after a failover. For more details, see the HA chapter of the FortiMail Administration Guide

9 FortiMail best practices Antivirus and spam definition updates Storing mail data on a NAS server while operating an HA group may have a number of benefits for your organization. For example, backing up your NAS server regularly can help prevent loss of FortiMail mail data. Also, if your FortiMail unit experiences a temporary failure you can still access the mail data on the NAS server. And when the FortiMail unit restarts the unit can usually continue to access and use the mail data stored on the NAS server. In HA mode, if you are using a NAS server you should disable mail data synchronization. If mail data synchronization is enabled for a FortiMail activepassive HA group that is using a NAS server for mail data, both the primary and backup units have the same NAS server configuration and so both would store mail data at the same location on the same NAS server. There is no benefit to storing mail data twice to the same location. So mail data synchronization should be turned off to save CPU cycles and network bandwidth. In a FortiMail HA group you can connect to both the primary unit and the backup unit web-based manager. Usually would connect to the primary unit for most configuration and management functions However, you can connect to the backup unit to view and manage log messages recorded on the backup unit hard disk. Use SNMP, syslog, or alerts to monitor a cluster for failover messages. These alert messages may aid in quick discovery and diagnosis of network problems. SNMP can be configured in System > Config > SNMP v1/v2c. Syslog output can be configured in Log & Report > Log Setting. alerts can be configured in Log & Report > Alert . If you configure a virtual IP in HA active-passive mode, you only need to configure one IP address and two host names in your DNS record. Antivirus and spam definition updates Configure the FortiMail unit to accept both scheduled and push updates of antivirus and attack definitions. FortiGuard updates are configured in System > Update. Before the FortiMail unit can receive antivirus updates, it must be able to connect to the FortiGuard Distribution Network (FDN). FDN connection status can be checked in System > Update. Allow the FortiMail unit access to a valid DNS server. DNS services are required to receive scheduled FortiGuard updates and to send alert . The DNS server used by the FortiMail unit is set in System > Network > DNS. Mail settings Configure a globally DNS-resolvable local domain name that is different than the domain name of your back end server (for gateway and transparent modes only). Proper MX record configuration is also needed for directing mail destined for the protected domains to this FortiMail unit (gateway mode). The local domain name will be used by many FortiMail features such as quarantine, Bayesian database training, spam reports, and DSN notifications. A subdomain of the protected main domain is recommended because of the domain registration savings

10 Antispam settings FortiMail best practices The local domain name should be globally DNS-resolvable only if the FortiMail unit is used as an outbound relay server. If this is the case, the local-domainsuffixed FortiMail host name and its IP address require proper DNS server configurations for both the forward and reverse lookup. Configuration of the related MX record associated with the local-domain-suffixed FortiMail host name is also recommended. Antispam settings A combination of recipient verification and sender reputation can help to prevent directory harvest attack (DHA). Directory Harvest Attack (DHA) is one of common methods used by spammers. It is an attempt to determine the valid addresses associated with an server so that they can be added to a spam database. If Recipient Verification (under domain settings) is enabled on the FortiMail unit, each recipient address will be verified by the backend server for its validation. For those destined to invalid recipient addresses, the FortiMail unit will return "User Unknown" messages to the senders. However, spammers will utilize this feature to determine valid or invalid user accounts associated with servers. To prevent this, you need to enable sender reputation in session profiles. Sender Reputation weights each sender (sender IP address) and assigns them a score. If the sender sends several messages to unknown recipients, the sender s reputation score would be increased significantly. And eventually, according to the score settings of sender reputation, this sender s upcoming SMTP sessions will be terminated at connection level. There are several places on the GUI to configure bounce verification. By default, bounce verification (under AntiSpam > Bounce Verification) is disabled. If you want to enable this feature, make sure that the Bypass Bounce Verification option in domain settings (under Mail Settings > Domains) is disabled, and also make sure the Bypass Bounce Verification check option in the session profile is disabled as well. An active key is also required to tag for bounce verification purpose. When configuring the bounce verification actions under Bounce Verification > Action, it is recommended to select the Use AntiSpam Profile Setting (default action). Policies Disable or delete policies and policy settings with care. Any changes made to the policy configuration using the GUI or CLI take effect immediately. IP-based policies are configured in System > Policy > IP Based and recipient-based policies are configured in System > Policy > Recipient Based. Arrange policies in the policy list from most specific at the top to more general at the bottom. Policy matches are checked from the top of the list, downward. For example, a very general policy matches all connection attempts. When you create exceptions to a general policy, you must add them to the policy list above the general policy

11 FortiMail best practices Maintenance If traffic matches no policies, it is allowed. If you re certain all desired traffic is allowed by existing policies, adding an IP policy to reject all connections at the bottom of the policy list can tighten security. To do this, create a new IP policy. Enter /0 as the address to match, and select Reject connections with this match. Finally, be sure to move this policy to the very end of the IP policy list. With this policy in place, the FortiMail unit s default behavior of allowing traffic with no policy matches is effectively reversed. Traffic with no other matches will now be denied by this final policy. Users can authenticate with the FortiMail unit using SMTP, POP3, IMAP, LDAP, or Radius servers. For users to be able to authenticate, an authentication profile must be created. LDAP profiles are configured in Profile > LDAP and all other authentication profiles are configured in Profile > Authentication. The addresses specified in an IP policy should be as specific as possible. Use subnets or specific IP addresses for more granular control. Use a 32-bit subnet mask when creating a single host address, for example, The IP settings /0 matches all. Use an asterisk (wild card) * to represent all users on a domain for recipientbased policies. Maintenance Always back up the FortiMail unit configuration, including Bayesian database, dictionary, and black and white lists, before upgrading or downgrading the firmware. Back up and restore the system configuration in the System Settings section of System > Status. Bayesian databases, dictionaries, and black and white lists are not included in the system configuration backup. They must be backed up separately. All Bayesian databases can be backed up by going to Anti-Spam > Bayesian > DB Maintenance and selecting Backup bayesian database. A Bayesian group user database can be backed up by going to Anti-Spam > Bayesian > User, choosing the domain, and selecting Backup group bayesian database. An individual Bayesian user database can be backed up by going to Anti-Spam > Bayesian > User, choosing the domain, entering the user name, selecting OK, and selecting Backup user bayesian database. Dictionaries are backed up in Profile > Dictionary > Maintenance. All dictionaries are included. All black and white lists can be backed up by going to Anti-Spam > Black/White List > Black/White List Maintenance. System lists can be backed up by going to Anti-Spam > Black/White List > System, choosing either Black List or White List, then selecting Backup. User lists can be backed up by going to Anti-Spam > Black/White List > Personal, choosing the correct domain, entering the user name, selecting OK, choosing either Black List or White List, and finally selecting Backup

12 Performance tuning FortiMail best practices Always upgrade to the latest available firmware. After downloading the updated firmware, go to System > Status and select the [Update] link beside the current firmware version indicator in the Unit Information section. In the window that appears, either enter the path and filename of the new firmware, or browse to locate it. Select OK to begin the firmware update. See the FortiMail Administration Guide for firmware updating instructions using the command line interface. Performance tuning Enable Verify Recipient Address (configured under individual domains) with a SMTP or LDAP server. This is especially important when quarantine is enabled because of the potentially large amount of quarantined mail for invalid users. Another feature to address the adverse effect on performance due to unnecessary quarantine is called Automatic Removal of Invalid Quarantine Accounts. If enabled, this feature deletes invalid user quarantine directories daily at 4:00 am. If spam quarantine is enabled and neither of these features are enabled, performance will suffer and could potentially cause the FortiMail unit to refuse SMTP connections if subject to extremely heavy mail traffic. Note: Microsoft Exchange server's user verification feature is disabled by default. Both Enable Verify Recipient Address and Automatic Removal of Invalid Quarantine Accounts are configured by going to Mail Settings > Domains, and selecting the Edit icon for the domain to be configured. Enable greylisting. Greylisting can prevent spam from being delivered so resources are not expended to identify it. Greylisting is enabled in antispam profiles by going to Profile > Anti-Spam > Incoming, selecting the Edit icon for the profile to be changed, and choosing Greylist scan. Define an IP policy with a session profile to take the advantages of session profile's spam throttling features. Sender reputation, session limiting, and error handling are particularly useful. Session profiles are selected by going to Policy > IP Based, selecting the Edit icon for the profile to be changed, and choosing the session profile in the drop down list. The session profiles themselves are created by going to Profile > Session, and selecting Create New. Enable caching and black IP scan if FortiGuard-AntiSpam is used. Caching can be enabled in Anti-Spam > FortiGuard-Antispam. Black IP scan can be configured by going to Profile > Anti-Spam, selecting either the Incoming or Outgoing tab, selecting the Edit icon of the profile to be modified, and expanding the FortiGuard-Antispam scan option. The DNS server(s) should be locally placed. If logs are stored on the FortiMail unit, set logging rotation size to between 10MB and 20MB, and event logging level to warning or above. Delete or backup old logs regularly to reduce local disk use. Local log file size limits are configured in Log & Report > Log Setting

13 FortiMail best practices Black and white lists Regularly delete or backup old reports to reduce the number of reports on the local disk. Regularly delete old and unwanted mail queue entries and quarantined mail. Schedule resource-intensive and non-time-critical tasks, such as report generating and delivery of the deferred oversize messages, to low-traffic periods. Disable resource-intensive scanning features, such as heuristic scanning, when spam capture rate is satisfactory. Scanning types are selected in antispam profiles by going to Profile > Anti-Spam, choosing either incoming or Outgoing, and selecting the Edit icon for the profile to be changed Consider enabling the Max message size to perform antispam scan and Bypass scan on SMTP authentication under scan conditions. These settings can be adjusted by going to Profile > Anti-Spam > Incoming, selecting the Edit icon for the profile to be configured, and expanding the Scan Conditions section. If possible, format the mail and log disks regularly to improve disk performance.! Caution: Formatting log disks will delete all the log entries. Formatting the mail disk with the execute formatmaildisk CLI command will also result in the loss of all the locally stored mail while execute formatmaildisk_backup will preserve the mail. These formatting operations will require a reboot when completed. Black and white lists Use black and white lists with caution. They are simple and efficient tools for fighting spam and enhancing performance. They can also cause false positives and false negatives if not used properly, however. For example, a white list entry *.edu would allow all mail from the.edu top level domain to bypass the FortiMail unit's anti-spam scanning. It is NOT recommended to whitelist the protected domain or addresses for the following reason: If a spammer uses the recipient address as the sender address to send spam, the AntiSpam feature will be completely bypassed if the recipient's address or domain is whitelisted. For example, if a spammer uses user@example.com as the sender address to send to this user, and if this address or its domain example.com is whitelisted, then the spam will pass through without being detected by the AntiSpam scanner. Network topology The FortiMail unit can be bypassed in a complex network environment if the network is not carefully planned and deployed. Spammers can easily determine the lowest priority mail server (highest preference number in MX record) and deliver spam to it in an attempt to avoid the most effective spam defenses. To ensure maximum safety: Configure the routing or firewall device to send all SMTP traffic to the FortiMail unit for scanning

14 FortiMail transparent mode FortiMail best practices Modify the DNS server to keep a single MX record entry for the FortiMail unit for all protected domains. Ensure all domains are protected by the FortiMail unit with a matched policy and proper profiles. FortiMail transparent mode Deploy the FortiMail unit in front of your mail server so incoming will go through the FortiMail unit and be scanned. The management IP address and all the IP addresses connecting to FortiMail unit's bridged (default) interfaces should be on the same IP subnet. Do not connect two ports to the same VLAN on a switch or to the same hub. Some Layer 2 switches become unstable when they detect the same MAC address originating on more than one switch interface or from more than one VLAN. If the client is configured for authentication and the Use original server to deliver mail option under For unknown Servers of SMTP proxies is NOT enabled, the FortiMail unit needs an authentication profile configured and applied. Without the profile, the authentication will fail in this situation. Also, the back end mail server needs to be explicitly configured to allow relay in this case

15

16