How to stop SMTP flooding

[#1]

I support a client who has a FG100A that has always been hit VERY hard with SPAM. I finally got the go-ahead to upgrade to build 318 recently. Until that update was applied I wasn' t convinced the Fortigate was blocking much SPAM. After the update SPAM detection was increased significantly and a high percentage of the SMTP traffic was being dropped. Today my client called me to say that their internal users can' t get out to the Internet. To make a long story short, they' re getting hit really hard by SPAM and it' s completely saturating their broadband connection. It takes me about 3 minutes to log into the Fortigate from outside their network. From the inside it' s very quick which confirms that the attack is coming from the outside. I contacted support who checked my settings and confirmed for me that this is the case. He noticed the CPU usage (12%) and Memory Usage (46%) were in the acceptable range so he was convinced the Fortigate wasn' t being over-taxed. When we disable the policy that allows incoming SMTP traffic everything works fine. As soon as I turn that policy back on I have over 1500 SMTP connections in 30 seconds. The connections seem to be coming from all different IP addresses. The tech suggested setting IPS/IDS to drop certain SMTP sessions which he said he did. I don' t see where he did this though. Today I upgraded to v3.0 build 400 and we still have the same problem. Does anyone have any suggestions on how to handle this kind of problem? On top of this there are no IPS statisitics on the status page so I' m not convinced that any SMTP " attacks" are being detected. HELP! My client is effectively dead in the water if I turn on SMTP and if I turn it off he can' t receive email. Thanks in advance.

[willmays]

Guy, If you can find the IP ranges the attacks are coming from, you could build address groups and deny SMTP traffic from these groups. However if they are all perfectly random, you will encounter alot of trouble! You would not see any IPS statistics being shown in the dashboard unless both IPS logging is turned on in the protection profile, and logging to memory is turned on with the relevant log memory filters being set via the CLI (see post http://support.fortinet.com/forum/tm.asp?m=21107&appid=&p=&mpage=1&key=&language=&tmode=&smode=&s=#21107) Alternative option, if you have backup MX servers in DNS, is to only allow traffic from the backup MX servers. This will cause the world to think your server is down, send to the backup MX, which will then be forwarded to your server. Sneaky, as it means another provider will deal with the brunt of the attack, but gets the customer working again! Regards, Will

[mickstrick_FTNT]

You could control this with ips anomalies, specifically tcp dst session limiting where the destination is your mail server. Anomalies have a default, which can be set from the gui, however from the cli you can build additional levels of limits that are selected using longest match lookup to find the correct threshold to apply. Then its up to you how apply them, you could create specific thresholds that allow a high number of sessions for know connecting good mail servers, and a low default (you would have to be careful where anomalies where enabled as you would only want this to apply to incoming smtp traffic). Also if you have identified ip addresses that are sending spam you can blacklist them in a ip bwl and use an action of reset, this way the sessions never establish. The benefit of using an ip bwl is that a less knowledgeable use can be granted access only to maintain the list, not the firewall policies.

[#4]

It seems like your clients Internal Exchage server trying to answer NDR. Check the Q of the Exchange server.

[#5]

I already disabled that in Exchange but the problem is that there' s so much flooding that it saturates their broadband and for some reason the Fortinet Model 100A (which is scaled adequately) is detecting some SPAM but much still gets through only to be detected by the internal anti-SPAM software (Symantec Mail Security for Exchange). If the Fortinet was doing a better job of detecting the SPAM I believe there' d be much fewer connections since they' d be dropped almost immediately and the pipe wouldn' t be saturated. Thanks for the response all the same. Guy

[#6]

Why don' t you limit the bandwidth of the inbound smtp policy? Then you have at least some bandwidth free for more important things (remote administration etc.)

[#7]

That' s funny, it too, me about 2 weeks to think of that idea - yesterday to be exact! I don' t know why I didn' t think of it sooner and I' m surprised nobody suggested it until you did. Included in the list of " others" who didn' t give me that suggestion earlier is Fortinet tech support. I spoke to two different techs for about 2 hours total and the idea never came up. I started to wonder if maybe Fortinets bandwidth throttling wasn' t good/reliable etc. and maybe that' s why nobody suggested it. Do you have experience either positive or negative with it? Thanks again. Guy