Auditing Mail Sending

Faced Problems

As shown in Figure 1, an enterprise deploys the FW as a gateway to connect the intranet to the Internet.

Intranet users send critical information or important files of the enterprise through mails. In case of a security event, the owner cannot be located or traced.

Figure 1 Auditing users' mail sending

Solution

With the audit function, the FW audits the mails sent by users, facilitating the locating and tracing of users and providing the basis for tuning security policies in the future.

Configure an audit policy based on the traffic sent from intranet users to access the Internet and reference the audit profile in the audit policy to audit users' posting behavior.

1. Log in to the web UI of the FW as the audit administrator.

2. Choose Object > Audit Configuration.

3. Click Add to create audit profile profile_audit and select Audit Email-Related Behavior to audit Sending.

   

4. Click OK.

5. Choose Policy > Audit Policy.

6. Click Add to create an audit policy. Configure matching conditions for the audit policy as required and reference the audit profile in the audit policy.

   Set audit policy parameters. The referenced user group named users has been created.

   Name	policy1
   Source zone	trust
   Destination zone	untrust
   Source Address/Region	192.168.0.0/255.255.255.0
   User	/default/users
   Action	Audit
   Audit Configuration	profile_audit

7. Click OK.

Verification

Choose Monitor > Log > Audit Log. You can find the logs generated when the FW audits the mails sent by users.

Configuration Scripts

The configuration script related to the example is as follows:

#                                                                                                                                   
profile type audit name profile_audit                                                                                               
 mail-audit send                                                                                                                    
#                                                                                                                                   
audit-policy                                                                                                                        
 rule name policy1                                                                                                                  
  source-zone trust                                                                                                                 
  destination-zone untrust                                                                                                          
  source-address 192.168.0.0 mask 255.255.255.0                                                                                     
  user user-group /default/users                                                                                                    
  action audit profile profile_audit                                                                                                
#