Security Profile Antivirus mail block

[panos]

Hi,

when you configure imap,smtp and pop3 block and in another profile alert;

is the only difference between them is just sending back 541 response on block ?

Or They are same (block or alert no difference)

Thanks.

[rmonvon · Accepted solution]

Hi...Alert action is to permit the traffic and log the event.  The alert action is the default action for imap, smtp, & pop3.  Block action will prevent the traffic & also log the event. For imap, smtp, & pop3, when the PA device blocks the traffic the sender will resend the email and the PA device will keep bolcking until the retry timeout.

Thanks.

[panos]

Ok I found it.

When an antivirus profile is set to a block action for these decoders, an SMTP 541 error message will be sent as part of the block action when a virus is detected. This will tell the mail server not to retry sending the message, allowing the firewall to drop the mail without the mail server trying to resend it.