Install and configure email handling solutions on TMG 2010 Firewall - Part 4

Network Administration - In Part 4 of this series, I will show you the virus and content filtering features on TMG 2010 Firewall.

Install and configure the solution to handle email on TMG 2010 Firewall - Part 1: Installation

Install and configure email handling solutions on TMG 2010 Firewall - Part 2: E-Mail Policy

Install and configure email handling solutions on TMG 2010 Firewall - Part 3: Anti-spam

In Part 3 of this series, I showed you how to configure the anti-spam feature on the TMG email handling solution. This part 4 will continue with the introduction of content and virus filtering features.

Content filtering and virus

In the TMG firewall console, click Email Policy on the left pane. In the middle pane of the interface, click the Virus and Content Filtering tab. You will then see three options for content filtering to protect TMG's email. That is:

In the image below, you can see two links indicating that Content Filtering and Virus Filtering features are enabled.

Filter files

Let's start with the File Filtering option. Click the File Filtering link in the middle pane. In the File Filtering dialog box, you will see the File Filters tab. Here you can configure file filters to block incoming and outgoing attachments. Click the Add button, as shown in Figure 2 below.

You will see the File Filter dialog box. On the General tab, you can choose the following options:

The options in the General tab are shown in Figure 3 below.

Click the File Types tab. Here you can control the type of file to be inspected. When the system detects a certain file type selected for inspection, the action you configure on the General tab will be executed. Note that this is a feature of Forefront Protection for Exchange (FPE), so the detection for file types is real, not just file extensions. That's a pretty interesting thing because the files can be renamed to indicate that the extension is different from what it really is. You can see the File Types tab in Figure 4 below.

Next, click the File Names tab. Here you can configure the file name so that the system will search in email attachments. You can enter the full file name, or you can use wildcards like '?' and '*'. '?' This is used to replace a certain character in a string, and '*' is used to replace certain unknown characters. The File Names tab is shown in Figure 5.

See page 2 : Antivirus configuration

---

Antivirus configuration

Let's take a look at the email Antivirus configuration on the TMG firewall. Click the Virus Filtering link in the middle pane of the console. There are many benefits to using many antivirus engines: increasing the ability to catch new threats even without all the machines being updated to this emergency threat, and providing caution in in case a machine has trouble or is not updated promptly, other machines can still add work to it. You can activate up to 5 different machines. Note that the more machines you have, the better, but you'll pay for performance.

The first tab we will work with is Engines . In this tab we have the following options:

You can see all of these options in Figure 6:

Click on the Remediation tab. On this tab we have the following options:

You can see this dialog in Figure 7.

Finally, click the Options tab. This is a tab with the following options:

Figure 8

See page 3: Filter content in the body (Body) email

---

Filter content in the body (Body) email

Click the Message Body Filtering link in the middle pane of the console. In the Message Body Filtering dialog box, click the Message Body Filters tab. Click the Add button. You will now see the Message Body Filter dialog box shown in Figure 8 below. On the General tab, you have the following options:

Click the Keywords tab in the Message Body Filters dialog box, as shown in Figure 10. Here you can define keywords for checking within the body of the message. Can use discrete words or can take advantage of the keyword list syntax rules, acting as the content queries of the message. The query syntax is quite complicated, but the TMG firewall team did a good job in detailing how to build these queries, completely through examples. You can check their instructions here.

Conclude

In this section, I have explained the Virus Filtering and Content Filtering options. Using TMG, you can lock incoming and outgoing mail containing malware; or messages that contain content within the subject or body of the message that you deem unacceptable. In the next part of this series, we will introduce the procedure used to create the Edge Subscription with the back-end Exchange Server. This is a valuable feature because it allows you to perform recipient filtering so that it can block certain messages to certain addresses in your organization.