Configuring profiles : Configuring content profiles and content action profiles : Configuring content profiles : Configuring scan options
Configuring scan options
The following procedure is part of the content profile configuration process. For general procedures about how to configure a content profile, see “Configuring content profiles and content action profiles”.
1. Go to Profile > Content.
2. Click New to create a new profile or double click on an existing profile to edit it.
3. Click the arrow to expand Scan Options and configure the following:
GUI item
Description
Detect fragmented email
Enable to detect and block fragmented email.
Some mail user agents, such as Outlook, can fragment big emails into multiple sub-messages. This is used to bypass oversize limits/scanning.
Detect password protected Office document
Enable to apply the block action configured in the content action profile if an attached MS Office, OpenOffice, PDF document is password-protected, and therefore cannot be decompressed in order to scan its contents.
Bypass scan on SMTP authentication
Enable to omit content profile scanning if the SMTP session is authenticated.
Check Archive Content
Enable to determine which action to perform with the archive attachments. The supported archive file types and extensions are listed under Profile > Content > File Filter.
• blocking password protected archives if you have selected Detect Password Protected Archive
• blocking archives that could not be successfully decompressed if you have selected Detect on Failure to Decompress
• passing/blocking by comparing the depth of nested archives with the nesting depth threshold configured in Max Level of Compression
By default, archives with less than 10 levels of compression will be blocked if they cannot be successfully decompressed or are password-protected.
Depending on the nesting depth threshold and the attachment’s depth of nested archives, the FortiMail unit may also consider the file types of files within the archive when determining which action to perform. For details, see the section below.
If disabled, the FortiMail unit will perform the Block/Pass action solely based upon whether an email contains an archive. It will disregard the depth of nesting, password protection, successful decompression, and the file types of contents within the archive.
Detect on Failure to Decompress
Enable to apply the block action configured in the content action profile if an attached archive cannot be successfully decompressed, such as if the compression algorithm is unknown, and therefore cannot be decompressed in order to scan its contents.
This option is available only if Check Archive Content is enabled.
Detect Password Protected Archive
Enable to apply the block action configured in the content action profile if an attached archive is password-protected, and therefore cannot be decompressed in order to scan its contents.
This option is available only if Check Archive Content is enabled.
Max Level of Compression
Enter the nesting depth threshold. Depending upon each attached archive’s depth of archives nested within the archive, the FortiMail unit uses one of the following methods to determine if it should block or pass the email.
• Max Level of Compression is 0, or attachment’s depth of nesting equals or is less than Max Level of Compression: If the attachment contains a file that matches one of the other MIME file types, perform the action configured for that file type, either block or pass.
• Attachment’s depth of nesting is greater than Max Level of Compression: Apply the block action, unless you have deselected the check box for Max Level of Compression, in which case it will pass the MIME file type content filter. Block actions are specified in the content action profile.
The specified compression value is always considered if Check Archive Content is enabled, but has an effect only if the threshold is exceeded.
This option is available only if Check Archive Content is enabled.
Check embedded component
Documents, similar to an archive, can sometimes contain video, graphics, sounds, and other files that are used by the document. By embedding the required file within itself instead of linking to such files externally, a document becomes more portable. However, it also means that documents can be used to hide infected files that are the real attack vector.
Enable to, for MIME types such as Microsoft Office, Microsoft Visio, and OpenOffice.org documents, scan files that are encapsulated within the document itself.
Defer delivery of message on policy match
Enable to defer mail delivery from specific senders configured in policy to conserve peak time bandwidth at the expense of sending low priority, bandwidth consuming traffic at scheduled times. For example, you can apply this function to senders of marketing campaign emails or mass mailing.
For information on policy, see “How to use policies”.
For information on scheduling deferred delivery, see “Configuring mail server settings”.
Defer delivery of messages larger than
Enter the file size limit over which the FortiMail unit will defer processing large email messages. If not enabled, large messages are not deferred.
For information on scheduling deferred delivery, see “Configuring mail server settings”.
Maximum number of attachment
Specify how many attachments are allowed in one email message. The valid range is between 1 and 100. The default value is 10.
Detect HTML content
Enable to detect hypertext markup language (HTML) tags and, if found:
• convert HTML to text: convert the HTML content to text only content.
• sanitize HTML content: produce new HTML content by removing the potentially tags and and attributes and only preserving the safe and essential tags.
• remove the contained URIs