Email gateway under attack

3 replies
3317 views
Translate All

Have a fortigate 60D which pushes only smtp /https traffic to our email gateway. However seeing quite a lot of authentication failures on our barracuda the email firewall. IPS and AV is enabled for the UTM . Any way to check this out. Cant do block by ip isnce it is random ip on a daily basis. Running firmware 5.0.10

emnocAnswer

New Member

if it's pure auth failures you can write a custom signature

http://socpuppet.blogspot.com/2014/07/example-fo-smpauth-protection-fortigate.html

rwpatterson

New Member

Can you spot a trend in the IP addresses by location (global location)? The Fortigates in newer versions support policies by region.

Translate

emnocAnswer

New Member

if it's pure auth failures you can write a custom signature

http://socpuppet.blogspot.com/2014/07/example-fo-smpauth-protection-fortigate.html

Translate

seadave

New Member

You might be able to use a DoS policy to drop by source or what I do is have all of my IPS rules setup to ban source IPs for 30 days once triggered. Stops a lot of these guys in there tracks. Make sure you aren't NAT'ing inbound by mistake. I did this once a long time ago and it caused all sorts of problems.

Translate

Sign up

Login with SSO

Login to the community

Login with SSO