10MB XLSX attachment, Unscannable due to limits exceeded

August 24, 2017, 4:16 am

≫ Next: How to configure Relay Recipients in SMG

I need a solution

Having the same issue as posted here:
https://www.symantec.com/connect/forums/unscannabl...

XLSX file size is less than 10MB, extracts to 140MB. I set the SMG limit to 500MB (which seems silly that I'd even have to do) and still I cannot get the email to release from the spam quarantine or deliver if I have the email re-sent.

According to the audit logs, reason for quarantine is:
Unscannable due to limits exceeded, Reinsert

If I go to the Spam Quarantine and try to release it says:
Message(s) successfully released from quarantine.
Cannot submit the selected message(s) to Symantec Security Response. The request cannot be processed because request exceeds the limit size. For more information, see the Help or product documentation.

Email delivers to a Gmail account without issue and the attachment seems fine.

How can I get this email to pass through SMG??

↧

How to configure Relay Recipients in SMG

August 28, 2017, 11:04 pm

≫ Next: Is there a hardware status log in SMG?

≪ Previous: 10MB XLSX attachment, Unscannable due to limits exceeded

I need a solution

Hi,

I have SMG version-10.6.2-7, it have Antispam and Antivirus features enabled. I am also using a spam server which have spamassassin running on it. In spam server we have configured Relay_recipients which allow to receive emails from external domain only to those users whom have email IDs added in Relay_recipients file. I want to know, is it possibe to configure the relay recipient featuer in SMG and if possible then how?

Thanks and Regards;

Tahir

↧

Is there a hardware status log in SMG?

August 30, 2017, 9:35 am

≫ Next: syntax of content filtering rules

≪ Previous: How to configure Relay Recipients in SMG

I need a solution

I had a report of high CPU consumption of the SMG but I realized that there is no way to see a history of the hardware status.

Does anyone know if there is any log or any way to check this type of logs? For example, check the CPU usage from two days ago.

Hope anyone could help me.

Greetings!

↧

syntax of content filtering rules

August 31, 2017, 12:12 am

≫ Next: Wie scannt das SBG?

≪ Previous: Is there a hardware status log in SMG?

I need a solution

I receive a lot of spams whose body starts with a sequence:

<html>=0D<head>=0D</head><body>=0D

I am unsuccesfull to write content filtering policy and a rule to select all emails containing a row

</head><body>=0D

I suppose, there are some problems with html heads.

Can somebody help me ?

↧

Wie scannt das SBG?

August 31, 2017, 11:15 pm

≫ Next: Modifying the SSH login banner symantec messaging gateway

≪ Previous: syntax of content filtering rules

I need a solution

Hallo zusammen,

beim Durchsuchen der Audit Logs habe ich folgendes festgestellt. Es gibt regelmäßig Einträge über Mails, die Als Verdict "Spam, Virus, Contentfilter XY" eingetragen haben. Meine Frage daher wäre, wie scannen die Gateways eine Mail?

Ich dachte eigentlich der Ablauf wäre:

Reputation --> Spam --> Maleware --> Content.

Also alles nacheinander. Würde meiner Meinung nach auch Sinn machen, da Reputation und Spam ja schon über 80% raus filtern und dann nicht tausende Mails unnötig auf Maleware geprüft werden müssten.

Jedoch hat es den Anschein als würden die Scans doch parallel laufen. Denn ich habe bei Spam definiert, dass eine Mail die als Spam eingestuft wird, gelöscht werden soll (default Regel). Meines Verständnisses nach, dürfte die Mail dann doch gar nicht mehr auf Maleware oder Contentfilter geprüft werden. Ich würde gerne verstehen, wie dies zu Stande kommt.

Gibt es eine grafische Darstellung des Scanverhaltens? In den Admin Guides kann ich dazu nichts finden.

Vielen Dank für die Hilfe.

↧

Modifying the SSH login banner symantec messaging gateway

September 1, 2017, 9:51 am

≫ Next: Symantec Email Submission Client (SECS) on Exchange 2016

≪ Previous: Wie scannt das SBG?

I need a solution

esxi-issues-message.png

↧

Symantec Email Submission Client (SECS) on Exchange 2016

September 5, 2017, 12:15 am

≫ Next: SMG License Invalid - Doesn't update SPAM definitions

≪ Previous: Modifying the SSH login banner symantec messaging gateway

I need a solution

Good day,

simple question: Will SECS work with Exchange 2016?
The latest Implementation Guide I could find is: https://support.symantec.com/en_US/article.DOC8042.html
It only covers Exchange until Version 2013.

Best regards
Daniel

↧

SMG License Invalid - Doesn't update SPAM definitions

September 7, 2017, 7:49 am

≫ Next: Anti spoofing rule

≪ Previous: Symantec Email Submission Client (SECS) on Exchange 2016

I need a solution

Hi guys!

I have a SMG with trial license but the SPAM definitions are not up to date. I've rebooted the server, restarted the Conduit service, and reloaded the license but the issue persists.

This is the log that the Control Center shows:

Date:	Thursday, Sep 07, 2017 09:38:08 AM CDT
Severity:	Error
Host:	Local Host
Log type:	Conduit
Description:	Error from web server 471 - License Invalid : unable to GET: https://aztec.brightmail.com/rules5/dayzero.vcdiff/4/latest.

Hope anyone could help me.

Greetings!

↧

Anti spoofing rule

September 11, 2017, 10:00 am

≫ Next: Anti spoofing rule

≪ Previous: SMG License Invalid - Doesn't update SPAM definitions

I do not need a solution (just sharing information)

Hi,

im have some dificult to block email that spooging my domain. What is the best way to block these e-mails?

Thanks.

↧

Anti spoofing rule

September 11, 2017, 10:45 am

≫ Next: Update Error from SMG 10.6.2-7 to 10.6.3-2

≪ Previous: Anti spoofing rule

I do not need a solution (just sharing information)

Hi,

im have some dificult to block email that spooging my domain. What is the best way to block these e-mails?

Thanks.

↧

Update Error from SMG 10.6.2-7 to 10.6.3-2

September 13, 2017, 12:26 am

≫ Next: Question on quarantine and scanning sequence in SMG

≪ Previous: Anti spoofing rule

I need a solution

When I updated the SMG from 10.6.2-7 to 10.6.3-2, and got the attached print screen. How could I solve the problem?

Thanks.

↧

Question on quarantine and scanning sequence in SMG

September 13, 2017, 12:33 am

≫ Next: Messaging Gateway as Open Relay Using Quarantine Port

≪ Previous: Update Error from SMG 10.6.2-7 to 10.6.3-2

I need a solution

1. How could I check the size of quarantine folder?

2. What is the scanning sequence in SMG? e.g. Content filtering --> Malware --> Spam --> ...

Thanks.

↧

Messaging Gateway as Open Relay Using Quarantine Port

September 14, 2017, 7:39 am

≫ Next: Messaging Gateway is an end-of-life product that has been discontinued

≪ Previous: Question on quarantine and scanning sequence in SMG

I need a solution

Greetings,

Its my understanding that the Symantec Messaging Gateway accepts quarantined Emails on a specified port. We found that it can be used as an open relay using that port. Is there a way to filter what hosts the gateway will accept quaratined Emails on? The only options we see are to change the port or disable it.

Thank You,

↧

Messaging Gateway is an end-of-life product that has been discontinued

September 15, 2017, 7:54 am

≫ Next: changing SMG ip addresses and routes

≪ Previous: Messaging Gateway as Open Relay Using Quarantine Port

I do not need a solution (just sharing information)

Hello SMG community,

This is an FYI... My company tried to renew its licensing for SMG 10.6 and our Symantec Sales account manager answered with this very simple sentence "Messaging Gateway is an end-of-life product that has been discontinued". Being very surprised, I tried to confirm with Symantec support but apparently they had no clue of what I was asking them.

So far, I have 2 different sources at Symantec confirming the product is EOL - excluding their own support.

Did I miss something? Has Symantec already announced EOL of SMG?

Cheers,

↧

changing SMG ip addresses and routes

September 18, 2017, 1:17 pm

≫ Next: SMG connection best practice

≪ Previous: Messaging Gateway is an end-of-life product that has been discontinued

I need a solution

I have SMG appliance with os 10.6 .it works as CC & scanner in the same time both outbound & inbound scanner are configured on the 2 interfaces I will need to move it to new DMZ so all IP addresses , static routes & default route nteed to be changed what is the best practice to do this as I tried to change it for testing from webconsole and apply the CLI commands but it reverted to old IP addresses after restart

↧

SMG connection best practice

September 18, 2017, 1:24 pm

≫ Next: External senders don't receive 552 5.3.4 NDR

≪ Previous: changing SMG ip addresses and routes

I need a solution

I have SMG which will work as CC & scanner the SMG should be placed between FW & Exchange server what is the best practice of connecting the interfaces Eth0 external to FW or Eth1 ?

and where to implement the outbound & inpound filter

↧

External senders don't receive 552 5.3.4 NDR

September 21, 2017, 6:31 am

≫ Next: Mensagens recebem bypass

≪ Previous: SMG connection best practice

I need a solution

Hi All,

We use Exchange 2010 SP2 as CAS+Hub Transport+Mailbox and Brightmail 10.6.3-2. The limit for inbound messages is 30MB on Brightmail and 20MB on Exchange.

When an external sender try to send a message to non-existing user (in our organizsation) he gets the NDR:

"The e-mail address you entered couldn't be found. Please check the recipient's e-mail address and try to resend the message. If the problem continues, please contact your helpdesk." - works correctly.

But when the same sender tries to send a message with size more then 20MB he won't get the NDR. The only delivery problem report I can see is in brightmail log:

"552 5.3.4 message size exceeds fixed maximum message size"

My questions are

"How to configure Brightmail to send NDR for 552 5.3.4?"

"How to redirect NDR fro Exchange to the original sender?"

Please assist.

Regards,

↧

Mensagens recebem bypass

September 21, 2017, 6:57 am

≫ Next: Eficiência em anti-spam

≪ Previous: External senders don't receive 552 5.3.4 NDR

I need a solution

Bom dia,

gostaria de saber se alguem já evidenciou e-mails que chegam no formato send-conta_de_email-1618-meu_dominio.com.br-8@dominio_do_spam.com.br que no caso, usa uma conta de e-mail valida como meu dominio @ o dominio do remetente do spam e recebem bypass? Creio que o bypass esteja sendo dado por haver o meu dominio no endereço de e-mail, ja criei filtros de conteudo para bloquear estas mensagens mas, não conseguem bloquea-las, ao que parece, que elas recebem o bypass antes de serem analisadas pelo content filter.

Obrigado,

Felippe.

↧

Eficiência em anti-spam

August 21, 2017, 6:14 am

≫ Next: Unscannable due to malformed MIME

≪ Previous: Mensagens recebem bypass

I do not need a solution (just sharing information)

Bom dia,

existe um guia de melhores pratica na classificação de spam com o SMG? Já tenho a ferramenta configurada conforme as recomendações da Symantec, porem, ainda recebo muitos spams em algumas contas de e-mail.

Obrigado.

↧

Unscannable due to malformed MIME

September 26, 2017, 6:16 am

≫ Next: Symantec Messaging Gateway Spam Reason

≪ Previous: Eficiência em anti-spam

I need a solution

Hi,

We're receiving a lot of legitimate messages that are deemed "Unscannable due to malformed MIME". As the default rule in the Malware module for "Unscannable for Malware and Content Filtering" is to delete the message, I've changed this to "Hold message in Spam Quarantine". However I believe this won't necessarily catch all messages with malformed MIME and I've seen old posts referring to enabling hidden advanced features in the GUI or, more reacently, contacting Symantec support:

https://support.symantec.com/en_US/article.TECH926...

if we can just get malformed MIME messages to ALL go to the administrator's quarantine I will be happy. Can someone give me a definite solution on this please?

↧