Manual Chapter :
Securing SMTP Traffic Using the Default Configuration
Applies To:
Show Versions
BIG-IP ASM
- 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1
Overview: Securing SMTP traffic using system defaults
This implementation describes how to secure SMTP traffic using system defaults. When you create an SMTP security profile, the BIG-IP Advanced Firewall Manager (AFM) provides several security checks for requests sent to a protected SMTP server. When you enable a security check, the system either generates an alarm for, or blocks, any requests that trigger the security check.
You can configure the SMTP security profile to include the following checks:
- Verify SMTP protocol compliance, as defined in RFC 2821.
- Validate incoming mail using several criteria.
- Inspect email and attachments for viruses.
- Apply rate limits to the number of messages.
- Validate DNS SPF records.
- Prevent directory harvesting attacks.
- Disallow or allow some of the SMTP methods, such as VRFY, EXPN, and ETRN, that spam senders typically use to attack mail servers.
- Reject the first message from a sender, because legitimate senders retry sending the message, and spam senders typically do not. This process is known as greylisting. The system does not reject subsequent messages from the same sender to the same recipient.
Task Summary
Creating an SMTP service profile with security enabled
The easiest method for initiating SMTP protocol security for your SMTP virtual
server traffic is to use the system default settings. You do this by enabling protocol
security for the system-supplied SMTP service profile, and then associating that service
profile with a virtual server.
You now have a security-enabled service profile that you can associate with a virtual
server so that SMTP protocol checks are performed on the traffic that the SMTP virtual
server receives.
