topic Re: Security Profile Antivirus mail block in General Topics

Security Profile Antivirus mail block

Retired Member — Sat, 01 Jun 2013 07:20:22 GMT

Hi,

when you configure imap,smtp and pop3 block and in another profile alert;

is the only difference between them is just sending back 541 response on block ?

Or They are same (block or alert no difference)

Thanks.

Re: Security Profile Antivirus mail block

rmonvon — Sun, 02 Jun 2013 15:47:14 GMT

Hi...Alert action is to permit the traffic and log the event. The alert action is the default action for imap, smtp, & pop3. Block action will prevent the traffic & also log the event. For imap, smtp, & pop3, when the PA device blocks the traffic the sender will resend the email and the PA device will keep bolcking until the retry timeout.

Thanks.

Re: Security Profile Antivirus mail block

Retired Member — Sun, 02 Jun 2013 16:38:33 GMT

Ok I found it.

When an antivirus profile is set to a block action for these decoders, an SMTP 541 error message will be sent as part of the block action when a virus is detected. This will tell the mail server not to retry sending the message, allowing the firewall to drop the mail without the mail server trying to resend it.