CLI: Example for Configuring Mail Filtering by Email Address or Attachment
This section provides an example for configuring mail filtering by email address or attachment on the FW that serves as the security gateway on the intranet.
Networking Requirements
An enterprise has about 200 employees who work for two departments: sales and R&D. In addition, the enterprise has a domain name of its own and deploys a mail server on the intranet.
Restricts the mail transmission permissions to prevent confidential information from being leaked. To be more specific,
- In the R&D department, only a few employees can send and receive email, and the others can receive but cannot send email.
- In the sales department, all employees can send and receive email, but the maximum size of attachments cannot exceed 10 MB.
Configuration Roadmap
Construct the intranet for the enterprise and deploy the FW as the security gateway.
- Add the mail server to the dmz.
- Add all the employees in the sales department to the user-defined sale security zone.
- Add all the employees in the R&D department to the user-defined research security zone.
- Add the Internet to the untrust zone.
-
The mail filtering profile is zone-specific. Plan the mail filtering policies for the security zones.
Purpose
Configuration Roadmap
Grants John and Jane the permission to send and receive email, and other employees in the R&D department only the permission to receive email.
Enable mail address checks in the sending direction between the research zone and the dmz to filter out email based on the sender addresses. Only John and Jane are permitted to send email.
Grants all employees in the sales department the permission to send and receive email, but restricts the attachment size per email message to a maximum of 10 MB.
Enable the mail attachment control in the sending direction between the sale zone and the dmz to restrict the maximum attachment size to 10 MB.
Procedure
- Set the interface IP address and add the interface to a security zone.
- Enable the mail attachment control in the sending direction between the sale zone and the dmz to restrict the maximum attachment size to 10 MB.
- Enable the mail address check in the sending direction between the research zone and the dmz to filter out email based on the sender email addresses. Only John and Jane are permitted to send email.
- Commit the content security profiles.
[FW] engine configuration commit Info: The operation may last for several minutes, please wait. Info: MAIL submitted configurations successfully. Info: Finish committing engine compiling.
Configuration Scripts
# sysname FW # interface GigabitEthernet0/0/1 undo shutdown ip address 1.1.1.1 255.255.255.0 # interface GigabitEthernet0/0/2 undo shutdown ip address 10.2.0.1 255.255.255.0 # interface GigabitEthernet0/0/3 undo shutdown ip address 10.3.0.1 255.255.255.0 # interface GigabitEthernet0/0/4 undo shutdown ip address 10.4.0.1 255.255.255.0 # firewall zone untrust add interface GigabitEthernet0/0/1 # firewall zone dmz add interface GigabitEthernet0/0/2 # firewall zone name sale id 4 set priority 60 add interface GigabitEthernet0/0/3 # firewall zone name research id 5 set priority 70 add interface GigabitEthernet0/0/4 # mail-address-group name mail_group_research pattern exact john_example@huawei.com pattern exact jane_example@huawei.com # profile type mail-filter name profile_mail_research_dmz send-mail sender filter-mode allow send-mail sender group name mail_group_research # profile type mail-filter name profile_mail_sale_dmz send-mail attachment max-size 10240 action block # security-policy rule name policy_sec_sale_dmz source-zone sale destination-zone dmz profile mail-filter profile_mail_sale_dmz action permit rule name policy_sec_research_dmz source-zone research destination-zone dmz profile mail-filter profile_mail_research_dmz action permit