Web: Example for Configuring RBL-Based Anti-Spam

This section provides an example for configuring mail filtering on the FW that serves as the security gateway on the intranet.

Networking Requirements

The enterprise has a domain name of its own and deploys a mail server on the intranet. RBL-based anti-spam is required to protect the mail server in the DMS against spam, reducing network resource consumption.

Figure 1 Mail filtering networking diagram

Procedure

Set the interface IP address and add the interface to a security zone.
1. Add GE0/0/1 to the untrust zone.
  1. Choose Network > Interface.
  2. Click for GE0/0/1 and set the parameters as follows:
    
    Zone
    
    untrust
    
    IP Address
    
    1.1.1.1/24
  3. Click OK.
2. Add GE0/0/2 to the dmz based on the preceding steps.
  The parameters of GE0/0/2 are as follows:
  
  Zone
  
  dmz
  
  IP Address
  
  10.2.0.1/24
Enable the RBL-based anti-spam function and set the DNS server address.
1. Choose Object > Security Profiles > Email Filtering.
2. Click Anti-Spam.
3. Enable the Anti-Spam Function.
4. Set the IP address of the primary DNS server to 10.10.10.10.
5. Click Apply.

Zone	untrust
IP Address	1.1.1.1/24

Zone	dmz
IP Address	10.2.0.1/24

Configure the mail filtering profile and use the RBL server cbl.anti-spam.org.cn.

In the RBL Filtering Profile group box, click Add.

Set the parameters of the RBL filtering profile.

Name	rbl server
Server Query Set	The query set is the RBL service name. It is used to locate the RBL server. For example, you can use cbl.anti-spam.org.cn as the query set.
Action	Block
Reply Code	Any Reply Code

Click OK.

Create a mail content filtering profile.
1. Click Email Content Filtering.
2. Click Add.
3. Set the name and description of the mail content filtering profile.
  
  Name
  
  profile_mail_untrust_dmz
  
  Description
  
  Mail filtering policy applied between the untrust zone and the dmz.
4. Enable the Anti-Spam.
5. Click OK.
Configure a security policy to permit the DNS traffic from the FW to the zone where the RBL server resides.
1. Choose Policy > Security Policy > Security Policy.
2. Click Add Security Policy and set the parameters as follows:
  
  Name
  
  policy_sec_rbl
  
  Description
  
  Ensure that the RBL query requests from the device are properly forwarded.
  
  Source Zone
  
  local
  
  Destination Zone
  
  untrust
  
  Service
  
  dns
  
  Action
  
  Permit
3. Click OK.

Name	profile_mail_untrust_dmz
Description	Mail filtering policy applied between the untrust zone and the dmz.

Name	policy_sec_rbl
Description	Ensure that the RBL query requests from the device are properly forwarded.
Source Zone	local
Destination Zone	untrust
Service	dns
Action	Permit

Configure the security policy between the dmz and the untrust zone.

Choose Policy > Security Policy > Security Policy.

Click Add Security Policy and set the parameters of the security policy between the untrust zone and the dmz as follows:

Content Security
Name	policy_sec_untrust_dmz
Description	Security policy applied between the untrust zone and the dmz.
Source Zone	untrust
Destination Zone	dmz
Action	Permit
Email Filtering	profile_mail_untrust_dmz

Click OK.

Click Submit on the upper right of the page.

Configuration Script

#                                                                               
sysname FW      
#                                                                               
 rbl-filter enable                                                              
 rbl-filter dns-server 10.10.10.10                                              
 rbl-filter profile user-defined name rbl server action block                   
 rbl-filter profile user-defined name rbl server enable                         
#                                                                               
interface GigabitEthernet0/0/1   
 undo shutdown
 ip address 1.1.1.1 255.255.255.0
#                                                                               
interface GigabitEthernet0/0/2   
 undo shutdown
 ip address 10.2.0.1 255.255.255.0
#                                                                               
firewall zone untrust                                                           
 add interface GigabitEthernet0/0/1
#                                                                               
firewall zone dmz                                                           
 add interface GigabitEthernet0/0/2
#                                                                               
profile type mail-filter name profile_mail_untrust_dmz                          
 rbl-filter enable                                                              
#                                                                               
 rbl-filter profile user-defined name rbl server                                
  query cbl.anti-spam.org.cn                                                    
  reply-code any description rbl server              
#                                                                               
security-policy                                                                 
 rule name policy_sec_untrust_dmz                                               
  source-zone untrust                                                           
  destination-zone dmz                                                          
  profile mail-filter profile_mail_untrust_dmz                                  
  action permit                                  
 rule name policy_sec_rbl                                                       
  source-zone local                                                             
  destination-zone untrust                                                      
  service dns                                                                   
  action permit