Email Security SonicWALL Email Security 6.0 Software Attention: Licensing has changed in Email Security 6.0. Be sure to read the Dynamic Licensing section in this Release Note before upgrading, and see the SonicWALL Email Security Getting Started Guide for complete information. Contents This document includes the following sections: SYSTEM COMPATIBILITY KEY FEATURES KNOWN ISSUES RESOLVED KNOWN ISSUES RELATED TECHNICAL DOCUMENTATION System Compatibility SonicWALL Email Security 6.0 Software is supported on systems with the following: Operating Systems Windows 2000, SP4 Windows 2003, SP1 Hardware Requirements Intel Pentium: Celeron, P4 or compatible CPU 1 Gigabyte RAM minimum Hard Disk: 40GB minimum Key Features in Email Security 6.0 The Email Security 6.0 Software release includes new management and effectiveness features including enhancements in the following areas: Dynamic Licensing and a New User Interface Hosted / Managed Service Provider Enhancements Reporting Enhancements Enhanced Effectiveness Enhanced Reporting Effectiveness
What s New in Management? A new user interface that represents the future of all SonicWALL products and licensing integrated with MySonicWALL are immediately noticeable, but Managed Service Providers will find significant enhancements to enable building a hosted service business, and reporting and appliance management round out the release. Dynamic Licensing and the New User Interface Dynamic Licensing Support Licensing has changed in SonicWALL Email Security 6.0. As part of this upgrade, the Email Security system interacts directly with mysonicwall.com to dynamically license all services. You do not need to input individual license keys. The new licensing system synchronizes with MySonicWALL to enable simplified license key management. Because of dynamic licensing in SonicWALL Email Security 6.0, before upgrading to this release you must verify that your Email Security product is registered to your mysonicwall.com account, and that your existing licenses are not expired. You can log into your account at https://www.mysonicwall.com/. To see all of your SonicWALL products, you can click View all registered products. To view the existing licenses for your Email Security product, you can click the product link. For example, the user interface of your Email Security system might display the information shown below: On mysonicwall.com you should see the same status and expiration dates for the same services: 2
Consider and verify the following: Check that the Customer ID in your Email Security 5.0 product is registered as a Serial Number in your MySonicWALL account Verify that each system has the appropriate subscriptions Services that you believe you have should not be expired If your Email Security product is not listed, or if your licenses are expired or do not show the status that you expected, you should contact SonicWALL support before upgrading to Email Security 6.0. To perform the upgrade, follow the procedure in the next section. For more information on Dynamic Licensing, see the SonicWALL Email Security Getting Started Guide for your product. Note: Customers that were originally with MailFrontier should take one extra step BEFORE they upgrade to 6.0: Log into MySonicWALL, copy the 27 character license key for Email Security, and paste that into the license field under License Management in the pre-6.0 user interface. Upgrading with Dynamic Licensing To upgrade to SonicWALL Email Security 6.0 and activate the upgraded license subscriptions: 1. Login to your mysonicwall.com account and confirm that your Email Security licenses are up to date. Note: If the licenses or subscriptions appear to be expired, contact SonicWALL support before upgrading to Email Security 6.0. Your current software will continue to function. 2. Download and install SonicWALL Email Security 6.0. Your settings and data will be kept. 3. Launch the Email Security user interface and log in as the administrator. 4. In the System > License Management screen, type your mysonicwall.com user name and password into the appropriate fields. 3
5. Click Submit. You will be directed to the Registration Completion screen. 6. In the Registration Completion screen, click Continue. You will be directed to the License Summary page. 7. After upgrading to the latest software, the system will reboot. Log in and navigate to System > License Management to activate your licenses. Licensing is now complete. The License Summary screen displays the status, expiration date, and other information about your Email Security licenses. 4
Left-hand Expandable Navigation in the New User Interface SonicWALL Email Security 6.0 features a new User Interface (UI) that represents the future of all SonicWALL products. A navigation bar is now displayed in the left pane, with expandable entries. Band Upgrades SonicWALL Email Security 6.0 provides a method for customers to upgrade their user band licenses to protect more users when their organizations outgrow their current licenses. Band upgrades apply to all subscriptions, but do not change subscription expiration dates. 5
Hosted/Managed Service Provider (MSP) Enhancements SonicWALL Email Security 6.0 introduces several features that are useful in a Managed Service Provider environment. The following features are available: Usermap importing Per-domain directory harvest attack protection management Per-domain reporting Per-path MTA queue management Zero-management remote access for junk box management Usermap Importing Usermap Importing in Email Security 6.0 gives the administrator the ability to import a list of non-ldap users for spam filtering and DHA protection. Administrators can import, export, add, and delete the non-ldap users to Email Security from the Users and Groups > Users screen. To add a number of users, an administrator can use an Excel spread sheet or text editor to generate a user list and save it as a tab-delimited file. The entries can be appended to the existing non-ldap user list, or the administrator can overwrite the list by selecting either append or overwrite in the Import Users dialog box. The modified list is imported to Email Security when you click Import. When the Import button is clicked, the Import Users dialog box displays: 6
Per-Domain Directory Harvest Attack (DHA) Protection Management In Email Security 6.0 you can manage Directory Harvest Attack (DHA) protection by specifying a single domain or a group of domains to be protected. Per-domain settings for DHA protection are available on the System > Connection Management screen. You can select from the following domain settings: Apply to all recipient domains This option provides the most comprehensive protection, and is recommended by SonicWALL for all domains where users are mapped into the product either via LDAP or User Import. Apply only to the recipient domains listed Use this option to specify one or more domains to protect. Apply to all recipient domains except those listed Use this option to exclude one or more domains from DHA protection. 7
Per-Domain Reporting Email Security 6.0 Per-Domain Reporting allows a Managed Service Provider (MSP) to see how much value is being provided to hosted customers. Several new reports are available for showing per-domain MSP related data. Email breakdown (custom/scheduled report only) Bandwidth (custom/scheduled report only) Good versus Junk per domain (custom/scheduled report only) 8
Per-Path MTA Queue Management SonicWALL Email Security 6.0 provides information about the number of messages in the Mail Transfer Agent (MTA) queue for each path that is configured to use the MTA. A path specifies how the data is sent through the SonicWALL Email Security solution. Of the five path types that can be configured, one is to act as a proxy which sends messages in real time and so does not maintain a queue. The other four path choices allow messages to be queued, and can now be individually monitored. These four path configurations are: MTA with SmartHost routing MTA with SmartHost routing and load balancing MTA with MX record routing MTA with MX record routing (with exceptions) In deployments where multiple MTA SmartHost or Mail Exchange (MX) paths use the same MTA, the per-path queue information can help the administrator monitor and balance the load on the MTA. The per-path MTA queue information is available in the Reports & Monitoring > Monitoring > MTA Status screen. Zero Management Remote User Login SonicWALL Email Security 6.0 allows you to configure remote Junk Box Summary access to individual junk boxes and settings. When this feature is enabled, users can login and gain full access by simply clicking a link in their Junk Box Summary. This allows organizations whose users are not authenticated by LDAP to access their junk boxes and settings without being required to enter their username and password. This feature can be enabled on the System > Junk Box Summary page: 9
Reporting Enhancements SonicWALL Email Security 6.0 provides several enhancements to reporting, including real-time system monitoring reports, the ability to download report data into a file using comma-separated values (CSV) format, and improvements to performance. Real-Time System Monitoring Reports For system monitoring, SonicWALL Email Security 6.0 provides real-time reports. The System Status screen on Reports & Monitoring > Monitoring shows live information and indicates whether SonicWALL Email Security is connected to the following: The SonicWALL data center The downstream mail server (for a Remote Analyzer or All-In-One) Real-time graphs are displayed for CPU History and CPU Usage: The Real-Time System Monitor screen on Reports & Monitoring > Monitoring shows message throughput and bandwidth usage per second in real-time: 10
Downloadable Data SonicWALL Email Security 6.0 provides the ability to download data into a CSV file for any report. When you click the Download Report button, a dialog box asks you to confirm the transfer of the data to your local system, and then allows you to select the location and file name for the.csv file. Improved Performance SonicWALL Email Security 6.0 features a unified reporting system architecture to improve the quality, reliability, and performance of the reporting system. 11
Effectiveness SonicWALL Email Security effectiveness enhancements in this release are focused on stopping image and stock ticker spam, adding infrastructure to handle new outbreaks, enhancing connection-level protection, and providing feedback and troubleshooting notifications. Effectiveness Enhancements Image Inference Engine In Email Security 6.0, blocking image spam is 35% more effective. For example, Email Security will detect and block images such as the following: Bayesian Rules Email Security 6.0 includes enhanced Bayesian rules, which filter email by identifying spam, and also includes parser enhancements such as the following: Improved URL extraction Generalizes for rotating domains and country codes Improved lexical distancing algorithm Helps defeat this new technique, also known as scrabble spam Improved phone number extraction Catches spam through increased recognition of phone numbers Stock Ticker Spam Update SonicWALL Email Security 6.0 provides improvements to the financial spam filter that was introduced in Email Security 5.0. 12
Enhanced Reporting Effectiveness Junk Box Summary Reporting Junk Box summaries now include: The number of included messages in the subject A total organization statistics chart Message Tagging From the System > Default Message Management screen, an administrator can define conditions for tagging messages arriving to their inbox. Message Tagging is turned on by default. The administrator can select from four options to tag the arriving messages. For each option you can type custom text into the field. The text is prefixed to the subject line of the message in your inbox. You can select any or all of the options to tag messages that are unjunked, included in the Allowed list, delivered because of a policy action, or used for deployment testing. 13
Connection Management Update SonicWALL Email Security 6.0 provides improvements on filtering Sender IDs. Email Security 6.0 checks emails received with a sender on an Allowed List against Sender ID. If the sender fails the Sender ID check, the Allowed List is ignored and the email is checked using other technologies. Smart Allowed Lists In Email Security 6.0, SPF and Sender ID-checked Allowed Lists and user notifications prevent risky additions. Additionally, warnings will be displayed when a user attempts to add inappropriate entries to the Allowed List, including the following: Your own email address Your organization s domain You can add to your Allowed List from several locations in the user interface. Domains are added on the Anti-Spam, Anti- Phishing > Companies screen by clicking Add on the Allowed tab. Adding your own domain will result in the following warning: You can add a Sender to your Allowed List on the Anti-Spam, Anti-Phishing > People screen. A similar warning is displayed if you add your own email address. The admin account is not affected; only regular user accounts can cause this warning. When you unjunk a message from your Junk Box Summary mail, you will see a similar warning dialog box. 14
Known Issues The following is a list of known issues in the SonicWALL Email Security 6.0 Software release: Administration 45012: Symptom: Audit page shows Header From, but search is on Envelope RCPT TO. Condition: Occurs in messages where the Envelope MAIL FROM field does not match the Header From field. Installation 45011: Symptom: When you launch an auto update over HTTPS w/a self signed cert, the Java applet that we run on your local machine will ask you if you want to trust the certificate. Then a second dialog appears asking if you want to proceed because the name on the self signed cert does not match the name in the URL for the server. You must answer Yes to both dialogs. Condition: Occurs when the certificate is not in the local keystore file for the JRE or JDK. Memory Symptom: Rapid memory growth when using some attachment policies. Condition: Occurs when a policy is used to look for strings in Attachment Name using the condition Contains or Does Not Contain based on terms in a Dictionary. Also occurred in Email Security 5.0.2 and 5.0.3. Workaround: Turn off policy or modify to look for Ends With or other alternative search criteria. If few terms, use individual policy terms separated by commas instead of using a Dictionary. Symptom: Rapid memory growth when using full Get Rich Quick. Condition: Occurs when the radio button for Anti- Spam Aggressiveness > Get Rich Quick is set to position 5. Also occurred in Email Security 5.0.2 and 5.0.3. Workaround: Change to an alternate radio button setting such as position 3 or 4. SMTP 45985: Symptom: Good recipients mail is delayed for delivery when the DHA option is enabled. Condition: Occurs when an incoming mail with several recipients is sent and one of the recipients is not a member of Active Directory. 49350: Symptom: A single, slow TLS client or connection can impact other TLS or non-tls sessions. Any TLS messages that time out may hold up other email connections causing problems for mailflow. Condition: Occurs when a TLS read/write retry happens at a low level. Auto-Update 48396: Symptom: The administrator is not currently notified when a server or appliance is going to reboot after an upgrade. Condition: Reboot occurs automatically when the administrator clicks the Upgrade now button and the autoupdate is complete. Dynamic Licensing Special Base Key Issue and Workarounds Symptom: The following workarounds are for customers who are original MailFrontier customers and are still running the older release. Workaround #1: Each customer has a base key in his/her mysonicwall account associated with each product. You should take that 27 char key from the mysonicwall page and enter it into the pre-6.0 product user interface under License Management. This will enable the client to write out the basekey with proper customer id that is associated with the spam key or something that the SonicWALL backend can recognize. After installing Email Security 6.0, log into the EmailSecurity UI, navigate to the System > License Management page and follow directions to sync with backend servers to pull corresponding licenses. Workaround #2: If the customer does not do Workaround #1 and the Email Security system goes into passthrough mode where the system stops filtering, you can make the following change to your license file (with the actual serial number) to fix it: Locate the license file on the system, which is called snwl_license.xml (location: <DATA_DIR>/license_info/<hostname>). 15
The following sample snippet shows the 'base_functionality' and 'spam' license from a sample snwl_license.xml file: <entry type="base_functionality"> <serial>454373</serial> <key>e6868b8bff1b</key> <expires>20600509</expires> <description>ae</description> </entry> <entry type="spam"> <serial>125038</serial> <key>56f8b12043bf</key> <expires>20090502</expires> <description>ae</description> </entry> Note: This workaround is valid only when the base_functionality serial field starts with '454' and the dyn_license.xml file does not exist. For all other issues, call SonicWALL Technical Support or your sales vendor. Perform the following steps: 1. Exit from all open browser windows on the Email Security system. 2. Make a copy of the snwl_license.xml file. 3. Copy the spam serial number to base_functionality. Here is how the above snippet changes: <entry type="base_functionality"> <serial>125038</serial> <--- ONLY CHANGE <key>e6868b8bff1b</key> <expires>20600509</expires> <description>ae</description> </entry> <entry type="spam"> <serial>125038</serial> <key>56f8b12043bf</key> <expires>20090502</expires> <description>ae</description> </entry> 4. Save the snwl_license.xml file. 5. Open a browser and log into the EmailSecurity user interface. 6. Navigate to the System > License Management link and log into mysonicwall and proceed from there. Note: Prior to Email Security 5.0, there was no snwl_release.xml file. Email Security only had license.xml which does not use basekey. Therefore, all pre-5.0 customers need to move to Email Security 5.0 or 5.0.x in order to create snwl_release.xml before exercising any of the above options. 16
Resolved Known Issues The following is a list of resolved known issues in the SonicWALL Email Security 6.0 Software release: Administration 48102: Symptom: Junk box summaries are sometimes delivered an hour later than scheduled, and in some cases not delivered at all. Condition: Occurs when Daylight Savings Time is in effect three weeks earlier than in previous years. Non-delivery occurs when outdated junk box templates are created when restoring Email Security 5.0.2 or earlier, and then the system is upgraded to 5.0.3 or later and junk box summaries are scheduled to be sent on a daily basis. 47868: Symptom: User can receive multiple junk box summaries. Condition: Occurs when the safe option is used when running sweeps of the junk box, which waits only a short time interval before expecting a successful return. Policy and Compliance SMTP 47539: Symptom: Policy filters based on a dictionary containing words with the German umlaut character do not catch all emails that contain the characters. Condition: Occurs when German words with umlauts are included in the email subject line. 47454: Symptom: Some RTF multi-part mime emails may be corrupted in transit to the recipient. Condition: Occurs when using Thunderbird email client to send an RTF-formatted email with an attachment when the email client is preconfigured with a policy that appends text to every email. Workaround: Turn off the disclaimer option. 47296: Symptom: Certain email message/policy combinations may cause the SMTP service to stop. Condition: Occurs when a specific email or email-type is sent through a certain policy containing actions on the email attachment(s). Workaround: Remove the policy that causes the SMTP service to stop. 48045/46636: Symptom: In some cases, emails or email attachments can become garbled. Condition: Occurs when the system has been running for a long time and may have a memory leak related to SMTP. 17
Related Technical Documentation SonicWALL user guides and reference documents are available at the SonicWALL Technical Documentation Online Library: http://www.sonicwall.com/us/support.html For basic and advance deployment examples, refer to SonicOS Guides and SonicWALL TechNotes available on the Web site. Part number: 232-001154-00 Revision: A Last updated: 6/13/2007 18