03-防病毒与反垃圾邮件报告.ppt

MUA –mail user agent MTA –mail transfer agent See RFC 822 for the “email rules” 自定义反垃圾邮件过滤启用 步骤一，在Email过滤器Profile中应用自定义反垃圾邮件过滤配置 IP地址黑白名单 E-mail地址黑白名单 禁忌词汇和阈值 自定义反垃圾邮件过滤启用 步骤二，把email过滤器应用在防火墙策略中 在防火墙策略内启用UTM email过滤器 应用第三方DNSBL与ORDBL服务器 使用DNSBL（基于DNS黑洞列表）与ORDBL（开放中继数据库列表）可过滤进入系统邮件并识别以及采取动作标注为垃圾邮件或拒绝邮件。DNSBL追踪被报告为垃圾邮件的源地址，ORDBL追踪不安全的第三方SMTP服务器。 通过命令行实现 Config spamfilter dnsbl edit 1 config entries edit 1 set server “ end set name chinarbl“ End 配置DNSBL服务器 DNSBL是一个基于DNS的黑名单, 能够有效阻止垃圾邮件。阻止垃圾邮件的最有效的方式是从垃圾邮件源头阻止,通过检查远程机器的IP地址是否在DNSBLs服务器中。 open relay指的是不需要进行任何的认证即可免费发送邮件的功能叫做open relay，在邮件发明的早期是一直是这个状态 垃圾邮件提示信息 丢弃邮件提示信息 主题标记 垃圾邮件提示信息替换 在系统管理配置替换信息垃圾邮件中更改替换信息 点击编辑按键，更改替换信息 实验 禁止发送含有“游戏”字样的邮件，给接收“游戏”字样的邮件在主题中打上标记“垃圾邮件” Note: These procedures are only available for the FortiGate-1000 and higher. There are two options for optimize. antivirusThe FortiGate unit spreads the antivirus scanning tasks across several CPUs (symmetric multiprocessing).throughputDefault setting. The FortiGate unit uses a single CPU to process traffic. The first problem deals with low memory situations. The antivirus system operates in one of two modes, conserve mode and non-conserve mode, depending on available memory for the whole FortiGate unit. If the free memory is greater than 30% of the total memory, then the system is in non-conserve mode. If the free memory drops to less than 20% of the total memory, then the system enters conserve mode. The system will not go back to?non-conserve mode until the free memory once again reaches 30% or greater of the total memory. The second problem deals with connection pools and has the av-failopen?feature?working on a localized level and affecting a single proxy.?If a FortiGate unit is receiving large volumes of traffic on a specific proxy, it is possible that the unit will exceed?the connection pool limit.? If the number of free connections within a proxy connection pool reaches zero, the av-failopen will be applied to that specific