topic Re: POP3, SMTP and IMAP setup in General Topics

POP3, SMTP and IMAP setup

Farzana — Tue, 04 Oct 2016 00:06:20 GMT

Hello,

Our POP3, SMTP and IMAP is currently set to Default (Alert) in the AV profile.

We have noticed malicious emails coming through and identified via Wildfire for staff using personal email addresses/computers using POP3 protocols? These personal computers are allowed on some of our remote sites.

Should POP3/SMTP and IMAP be set to Drop-reset for “Action” and “Wildfire” in the Anti-Virus security policy if it detects malicious file/link etc?

We are using Proofpoint to scan all our internal corporate email.

Thanks in Advance.

Re: POP3, SMTP and IMAP setup

BenjAudy.MTL — Tue, 04 Oct 2016 03:53:49 GMT

Hi,

For SMTP, choosing reset-both is a good idea because the firewall will send a 541 response to the sending SMTP server to prevent the message to be sent.

For POP3 and IMAP, reset-both seems to cause the email clients to retry downloading the offending message eternally, so it probably interferes with the normal operation of the client. Still, that behavior is probably better than getting viruses inside your network (even if it's on personal computers).

Regards,

Benjamin

Re: POP3, SMTP and IMAP setup

Farzana — Wed, 05 Oct 2016 04:25:28 GMT

Thank you Benjamin for your suggestion. Much appreciated.

Re: POP3, SMTP and IMAP setup

gtomte — Thu, 13 Oct 2016 16:55:11 GMT

I use reset-both for pop3 and imap, with no "known" problems. Blocks viruses like a charm... Even after SSL decrypt. This is gmail. THREAT ALERT : medium : 173.194.222.109 -> 192.168.4.164 Trojan-Downloader/VBS.agent.dpiwk(1210797) reset-both type: THREAT subtype: virus app: imap category: web-based-email contenttype: severity: medium direction: server-to-client sport: 993 dport: 49498 natsport: 993 natdport: 36862 flags: 0x81502000 proto: tcp action: reset-both

Re: POP3, SMTP and IMAP setup

jintan — Mon, 27 Mar 2017 09:09:17 GMT

hi,

could you share in details what you mean by no "known" problems?

after you set to "reset-both" for POP3/IMAP, did your email clients keep retrying to download the offending message eternally?

thanks for sharing.