Barracuda Spam Firewall Administrator's Guide
Version 3.x
Barracuda Spam Firewall Administrator’s Guide
Barracuda Networks Inc.
3175 S. Winchester Blvd
Campbell, CA 95008
http://www.barracuda.com
Copyright Notice
Copyright 2004-2008, Barracuda Networks
www.barracuda.com
v3.5-080801
All rights reserved. Use of this product and this manual is subject to license. Information in this document is subject to change without notice.
Trademarks
Barracuda Spam Firewall is a trademark of Barracuda Networks. All other brand and product names mentioned in this document are registered
trademarks or trademarks of their respective holders.
2 Spam Firewall Administrator’s Guide
Contents
Chapter 1 - Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 9
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Energize Updates Minimize Administration and Maximize Protection . . . . . 10
Understanding Spam Scoring . . . . . . . . . . . . . . . . . . . . . . . . 11
Inbound and Outbound Modes . . . . . . . . . . . . . . . . . . . . . . . . . 12
Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Warranty Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Barracuda Spam Firewall Models. . . . . . . . . . . . . . . . . . . . . . . . . . 13
Chapter 2 - Getting Started . . . . . . . . . . . . . . . . . . . . . . 15
Initial Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Checklist for Unpacking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Required Equipment for Installation . . . . . . . . . . . . . . . . . . . . . . . 16
Install the Barracuda Spam Firewall. . . . . . . . . . . . . . . . . . . . . . . 16
Configure the System IP Address and Network Settings . . . . . . . . . . . . 17
Configure your Corporate Firewall . . . . . . . . . . . . . . . . . . . . . . . 17
Configure the Barracuda Spam Firewall . . . . . . . . . . . . . . . . . . . . 18
Set the Administrative Options . . . . . . . . . . . . . . . . . . . . . . . . . 19
Update the System Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Verify your Subscription Status . . . . . . . . . . . . . . . . . . . . . . . . . 20
Route Incoming Email to the Barracuda Spam Firewall. . . . . . . . . . . . . 22
Port Forwarding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
MX Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Tune the Default Spam Settings. . . . . . . . . . . . . . . . . . . . . . . . . 22
Installation Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Barracuda Spam Firewall Behind Corporate Firewall . . . . . . . . . . . . . . 24
Barracuda Spam Firewall in the DMZ . . . . . . . . . . . . . . . . . . . . . . 25
Changing the Operating Mode to Outbound . . . . . . . . . . . . . . . . . . 26
Basic Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Setting up your Email Server as a Smart/Relay Host. . . . . . . . . . . . 27
Enable Smart Host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Disable Smart Host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Changing Outbound to Inbound Mode . . . . . . . . . . . . . . . . . . . . . 28
Basic Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Review the Administration Options . . . . . . . . . . . . . . . . . . . . . 28
Route Incoming and Outgoing Email to the Barracuda Spam Firewall . . . 29
Chapter 3 - Basic Tab . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Monitoring System Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Using the Status page. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Email Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Performance Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Subscription Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
iii
Hourly and Daily Mail Statistics . . . . . . . . . . . . . . . . . . . . . . . . . 34
Understanding the Indicator Lights . . . . . . . . . . . . . . . . . . . . . . . 34
Message Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Monitoring the Message Log . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Legend . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Classifying Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Overview of the Message Log. . . . . . . . . . . . . . . . . . . . . . . . . . 37
Changing the Viewing Preferences of the Message Log . . . . . . . . . . . . 38
Viewing Message Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Clearing the Message Log . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Spam Scoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Configuring the Global Spam Scoring Limits . . . . . . . . . . . . . . . . . . 40
Specifying the Subject Text and Priority of Tagged Messages . . . . . . . . . 41
Changing Notifications to Senders . . . . . . . . . . . . . . . . . . . . . . . 41
Spam Bounce (NDR) Configuration. . . . . . . . . . . . . . . . . . . . . 41
Virus Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Enabling and Disabling Virus Checking and Notification . . . . . . . . . . . . 42
Quarantine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Setting Up Quarantine Policies . . . . . . . . . . . . . . . . . . . . . . . . . 43
Specifying the Quarantine Type . . . . . . . . . . . . . . . . . . . . . . . . . 43
Specifying the Global Quarantine Settings . . . . . . . . . . . . . . . . . . . 44
Specifying the Per-User Quarantine Settings . . . . . . . . . . . . . . . . . . 45
IP Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Configuring System IP Information . . . . . . . . . . . . . . . . . . . . . . . 46
Administration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Controlling Access to the Administration Interface . . . . . . . . . . . . . . . 48
Changing the Password of the Administration Account . . . . . . . . . . . . . 48
Limiting Access to the Administration Interface and API . . . . . . . . . . . . 49
Allowing the Message Body in the Message Log . . . . . . . . . . . . . . . . 49
Changing the Web Interface Port and Session Expiration Length . . . . . . . 49
Shutting Down the System . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Resetting the System Using the Front Panel . . . . . . . . . . . . . . . . . . 51
Automating the Delivery of System Alerts and Notifications . . . . . . . . . . 51
Changing the Operating Mode of the System . . . . . . . . . . . . . . . . . . 51
Bayesian / Intent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Enabling Users to Classify Messages from a Mail Client . . . . . . . . . . . . 53
Using the Microsoft Outlook and Lotus Notes Plug-in. . . . . . . . . . . . . . 54
Managing the Bayesian Database . . . . . . . . . . . . . . . . . . . . . . . 54
Resetting the Bayesian Database. . . . . . . . . . . . . . . . . . . . . . . . 54
Sending Spam Messages to Barracuda Networks . . . . . . . . . . . . . . . 55
Enabling Intent Analysis. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Reducing Backscatter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Additional Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Chapter 4 - Using the Block and Accept Filters . . . . . . . 57
Subscribing to Blacklist Services . . . . . . . . . . . . . . . . . . . . . . . . 57
Blacklist Services Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . 58
What Happens if your Domain or IP Address is on a Blacklist . . . . . . . . . 59
IP Address Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Sender Domain Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Sender Email Address Filters . . . . . . . . . . . . . . . . . . . . . . . . . . 61
iv Barracuda Spam Firewall Administrator’s Guide
Recipient Email Address Filters . . . . . . . . . . . . . . . . . . . . . . . . . 61
Attachment Type Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Subject Line Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Body Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Header Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Chapter 5 - Managing Accounts and Domains . . . . . . . . 67
How the Barracuda Spam Firewall Creates New Accounts . . . . . . . . . . . 67
Viewing User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Using Filters to Locate Accounts . . . . . . . . . . . . . . . . . . . . . . . . 69
Editing User Accounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Removing Invalid User Accounts . . . . . . . . . . . . . . . . . . . . . . . . 70
Assigning Features to User Accounts . . . . . . . . . . . . . . . . . . . . . . 70
Overriding the Quarantine Settings for Specific User Accounts. . . . . . . . . 71
Setting Retention Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Adding New Domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Editing Domain Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Chapter 6 - Managing Your Quarantine Inbox . . . . . . . . . 75
Receiving Messages from the Barracuda Spam Firewall . . . . . . . . . . . . 75
Greeting Message. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Quarantine Summary Report . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Using the Quarantine Interface . . . . . . . . . . . . . . . . . . . . . . . . . 76
Logging into the Quarantine Interface. . . . . . . . . . . . . . . . . . . . . . 77
Managing your Quarantine Inbox . . . . . . . . . . . . . . . . . . . . . . . . 77
Changing your User Preferences . . . . . . . . . . . . . . . . . . . . . . . . 78
Changing your Account Password . . . . . . . . . . . . . . . . . . . . . . . 78
Changing Your Quarantine Settings. . . . . . . . . . . . . . . . . . . . . . . 78
Enabling and Disabling Spam Scanning of your Email . . . . . . . . . . . . . 79
Adding Email Addresses and Domains to Your Whitelist and Blacklist . . . 80
Changing the Language of the Quarantine Interface . . . . . . . . . . . . 81
Chapter 7 - Configuring A Domain . . . . . . . . . . . . . . . . . 83
Domain Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Chapter 8 - Setting Up LDAP . . . . . . . . . . . . . . . . . . . . . 85
Using LDAP to Authenticate Message Recipients . . . . . . . . . . . . . . . 85
Using LDAP for User Authentication . . . . . . . . . . . . . . . . . . . . . . 85
Impact of a Down LDAP Server . . . . . . . . . . . . . . . . . . . . . . . . . 88
Common LDAP Settings for Standard Mail Servers. . . . . . . . . . . . . . . 88
Chapter 9 - Advanced Administration . . . . . . . . . . . . . . 89
Email Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Modifying the Email Protocol Settings. . . . . . . . . . . . . . . . . . . . . . 90
Rate Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
v
Configuring Message Rate Control . . . . . . . . . . . . . . . . . . . . . . . 92
Explicit Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Activating Individual Accounts. . . . . . . . . . . . . . . . . . . . . . . . . . 93
Backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Backing Up and Restoring System Configuration . . . . . . . . . . . . . . . . 94
Performing Desktop Backups . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Automating Backups (inbound mode only) . . . . . . . . . . . . . . . . . . . 95
Restoring from a Backup File . . . . . . . . . . . . . . . . . . . . . . . . . . 96
Energize Updates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Updating Spam and Virus Definitions Using Energize Updates . . . . . . . . . 97
Spam Definition Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Virus Definition Updates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Firmware Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Updating the System Firmware Version. . . . . . . . . . . . . . . . . . . . . 99
Appearance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
Customizing the Appearance of the Administration Interface . . . . . . . . . 100
Syslog. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Using a Syslog Server to Centrally Manage System Logs . . . . . . . . . . 101
Outbound / Relay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Setting up Trusted Relays and SASL/SMTP Authentication . . . . . . . . . 102
Outbound Footer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Customizing the Outbound Footer . . . . . . . . . . . . . . . . . . . . . . 104
Advanced IP Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Configuring the Network Interfaces . . . . . . . . . . . . . . . . . . . . . . 105
Configuring Static Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Clustering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Setting Up Clustered and Standby Systems . . . . . . . . . . . . . . . . . 106
Cluster Set up Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Data Propagated to the Clustered Systems. . . . . . . . . . . . . . . . . . 107
Field Descriptions for the Clustering Page . . . . . . . . . . . . . . . . . . 108
Impact of Changing the IP Address of a Clustered System . . . . . . . . . . 109
Single Sign-On . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110
Implementing Single Sign-On . . . . . . . . . . . . . . . . . . . . . . . . . .110
SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .112
Enabling SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .112
Regional Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .115
Detecting Spam in Chinese and Japanese Messages . . . . . . . . . . . . .115
Bounce / NDR Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116
Customizing Non-Delivery Reports (NDRs) . . . . . . . . . . . . . . . . . . .116
Troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118
Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118
Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119
Generating System Reports. . . . . . . . . . . . . . . . . . . . . . . . . . .119
Displaying and Emailing Reports . . . . . . . . . . . . . . . . . . . . . . . .119
Automating the Delivery of Daily System Reports . . . . . . . . . . . . . . .119
Specifying Report Properties . . . . . . . . . . . . . . . . . . . . . . . . . 120
Example Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
SMTP / TLS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Enabling SMTP over TLS/SSL . . . . . . . . . . . . . . . . . . . . . . . . 122
Task Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Using the Task Manager to Monitor System Tasks . . . . . . . . . . . . . . 123
Recovery Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
vi Barracuda Spam Firewall Administrator’s Guide
Replacing a Failed System . . . . . . . . . . . . . . . . . . . . . . . . . . 124
Rebooting the System in Recovery Mode. . . . . . . . . . . . . . . . . . . 124
Tasks to Perform Before Rebooting in Recovery Mode . . . . . . . . . . . . 124
Performing a System Recovery or Hardware Test . . . . . . . . . . . . . . 125
Reboot Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
Chapter 10 - Outbound . . . . . . . . . . . . . . . . . . . . . . . . 127
Tabs and Pages Supporting Outbound Mode . . . . . . . . . . . . . . . . . 127
About Outbound Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Viewing Outbound Messages in the Message Log . . . . . . . . . . . . . . 129
Changing the Footers on Outbound Messages . . . . . . . . . . . . . . . . 129
Specifying Allowed Senders. . . . . . . . . . . . . . . . . . . . . . . . . . 130
Specifying Allowed Senders by Domain and IP Address . . . . . . . . . . . 130
Specifying Allowed Senders Using SMTP Authentication. . . . . . . . . . . 131
Additional Email Protocol Settings for Outbound Mode . . . . . . . . . . . . 131
Enabling Intent Analysis and Spam Scoring . . . . . . . . . . . . . . . . . 132
Managing the Quarantine Box . . . . . . . . . . . . . . . . . . . . . . . . 133
Sending NDRs for Quarantined Messages . . . . . . . . . . . . . . . . . . 133
Viewing and Classifying Quarantined Messages . . . . . . . . . . . . . . . 133
Using Filters to Locate Specific Messages . . . . . . . . . . . . . . . . . . 134
Configuring Message Rate Control . . . . . . . . . . . . . . . . . . . . . . 134
Adding a Relay Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Setting Up Subject and Body Filtering . . . . . . . . . . . . . . . . . . . . 136
Appendix A - Regular Expressions . . . . . . . . . . . . . . . 137
Using Special Characters in Expressions . . . . . . . . . . . . . . . . . . . 138
Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Appendix B - Limited Warranty and License. . . . . . . . . 141
Limited Warranty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
Exclusive Remedy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
Exclusions and Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . 142
Software License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
Energize Update Software License . . . . . . . . . . . . . . . . . . . . . . 143
Open Source Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Appendix C - Compliance . . . . . . . . . . . . . . . . . . . . . . 153
Notice for the USA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Notice for Canada . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Notice for Europe (CE Mark) . . . . . . . . . . . . . . . . . . . . . . . . . 153
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
vii
viii Barracuda Spam Firewall Administrator’s Guide
Chapter 1
Introduction
This chapter provides an overview of the Barracuda Spam Firewall and includes the following topics:
Overview ............................................................................................ 10
Barracuda Spam Firewall Models..................................................... 13
Introduction 9
Overview
The Barracuda Spam Firewall is an integrated hardware and software solution that provides powerful
and scalable spam and virus-blocking capabilities that do not impede the performance of your email
servers. The system has no per-user license fee and can be scaled to support tens of thousands of active
email users.
Using the Web-based administration interface, you can configure up to twelve defense layers that
protect your users from spam and viruses. The twelve defense layers are:
• Denial of service and security protection
• Rate control
•IP Analysis
• Sender Authentication
• Recipient Verification
• Virus Scanning
• Site-specific policies
• Fingerprint Analysis
• Intention Analysis
• Image Analysis
• Bayesian Analysis
• Rule-based spam scoring
The following figure shows each of these defense layers in action
Figure 1.1:
Energize Updates Minimize Administration and Maximize Protection
To provide you with maximum protection against the latest types of spam and virus attacks,
Barracuda Networks maintains a powerful operations center called Barracuda Central. From this
center, engineers monitor the Internet for trends in spam and virus attacks and post updated definitions
to Barracuda Central. These updates are then automatically retrieved by your Barracuda Spam
Firewall using the Energize Updates.
10 Barracuda Spam Firewall Administrator’s Guide
By identifying spam trends at an early stage, the team at Barracuda Central can quickly develop new
and improved blocking techniques and virus definitions that are quickly made available to your
Barracuda Spam Firewall.
Energize Updates provide your Barracuda Spam Firewall with the following benefits:
• Access to known offending IP addresses
• Known spam messages instantly blocked
• Known spam content blocked
• Virus definitions constantly updated
The following figure shows how Barracuda Central provides the latest spam and virus definitions
through Energize Updates.
Figure 1.2:
Understanding Spam Scoring
The Barracuda Spam Firewall scrutinizes all the characteristics of a message and uses a complex
system of scores to determine whether a message is spam. When an email reaches the spam scoring
filter, the Barracuda Spam Firewall assigns scores to all the properties of the message.
For example, the Barracuda Spam Firewall scrutinizes:
• A message’s header and subject line for offensive characters or words
• The percentage of HTML in the message
• Whether a message contains an “unsubscribe” link
Introduction 11
These properties (along with many others) help the Barracuda Spam Firewall determine the spam
score for a message that is displayed on the Message Log page of the administration interface.
Energize Updates keeps the spam rules and scores up-to-date so the Barracuda Spam Firewall can
quickly counteract the latest techniques used by spammers.
Inbound and Outbound Modes
The Barracuda Spam Firewall supports two operating modes:
• Inbound Mode (default) scans all incoming messages for viruses, custom policy, and spam
probability to ensure that all email delivered to your users is virus-free and legitimate. In
inbound mode, the Barracuda Spam Firewall also supports basic outbound mail scanning
through the "Outbound Relay" tab for companies who simply need to perform virus checking,
limited spam scanning capabilities, and appending of footers to outgoing mail. By default,
Barracuda Spam Firewalls are configured for inbound mode when shipped
• Outbound Mode offers more advanced capabilities that include custom outbound mail policy,
more comprehensive outbound spam scanning techniques, and outbound quarantine workflows
for postmasters or compliance officers to sideline mail that violates policy. More advanced
email applications may require deployment of separate Barracuda Spam Firewalls dedicated to
inbound and outbound mail scanning.
For information on how to configure your Barracuda Spam Firewall for outbound mode, refer to
Configuring your System for Outbound Mode on page 33. For information about the specific features
relating to outbound mode, refer to Chapter 10.
Technical Support
To contact Barracuda Networks Technical Support:
• By phone: call 1-408-342-5400, or if you are in the United States, (888) Anti-Spam, or (888)
268-4772
• By email: use support@barracuda.com
• Online: visit http://www.barracuda.com/support and click on the Support Case Creation link.
There is also a Barracuda Networks Support Forum available, where users can post and answer other
users’ questions. Register and log in at http://forum.barracuda.com.
Warranty Policy
The Barracuda Spam Firewall has a one (1) year warranty against manufacturing defects.
12 Barracuda Spam Firewall Administrator’s Guide
Barracuda Spam Firewall Models
The Barracuda Spam Firewall comes in a variety of models. Refer to the following table for the
capacity and features available on each model:
Table 1.1:
Feature
Active email users 1–500 300–1,000 1,000–
Domains 50 250 500 5,000 5,000 5,000
Quarantine Storage 10 GB 50 GB 100 GB 200 GB 250 GB
Compatible with all
email servers
Hardened and secure
OS
Spam blocking
Virus scanning
Outbound Email
Filtering
STARTTLS
encryption support
Per-user settings and
quarantine
Model
200
999999
999999
999999
999999
999999
999999
Model
300
Model
400
5,000
Model
600
3,000–
10,000
Model
800
8,000–
22,000
Model
900
15,000–
30,000
99999
MS Exchange/LDAP
Accelerator
Syslog support
SNMP/API
Per Domain Settings
Clustering
Redundant Disk Array
(RAID)
Per-user score
settings
Customizable
Branding
Hot Swap Redundant
Power Supply
99999
99999
9999
9999
9999
9
Hot Swap Hot Swap Hot Swap
999
999
Hot Swap Hot Swap
Introduction 13
14 Barracuda Spam Firewall Administrator’s Guide
Chapter 2
Note
Getting Started
This chapter covers:
Initial Setup ....................................................................................... 16
Installation Examples ........................................................................ 24
Operating Modes ............................................................................... 26
If you intend to use your Barracuda Spam Firewall to scan outgoing messages ONLY, or in addition
to incoming messages, refer to
Operating Modes on page 26 before you begin configuration.
Getting Started 15
Initial Setup
Warning
Note
Checklist for Unpacking
Thank you for purchasing the Barracuda Spam Firewall. Match the items on this list with the items in
the box.
If any item is missing or damaged, please contact your Barracuda Networks Sales representative.
• Barracuda Spam Firewall (check that
• AC power cord
• Ethernet cables
• Mounting rails (models 600, 800, and 900 only)
you have received the correct model)
Required Equipment for Installation
These are items that are needed for installing the Barracuda Spam Firewall:
•VGA monitor
• PS2 keyboard
Install the Barracuda Spam Firewall
To physically install the Barracuda Spam Firewall:
1. Fasten the Barracuda Spam Firewall to a standard 19-inch rack or other stable location.
Do not block the cooling vents located on the front and rear of the unit.
2. Connect a CAT5 Ethernet cable from your network switch to the Ethernet port on the back of
your Barracuda Spam Firewall.
The Barracuda Spam Firewall supports both 10BaseT and 100BaseT Ethernet. Barracuda
Net
works recommends using a 100BaseT connection for best performance.
The Barracuda Spam Firewall models 600 and higher support Gigabit Ethernet and has two usable
LAN ports. On these models, plug the Ethernet cable into the LAN 2 port.
Do not connect any other cables to the other connectors on the unit. These connectors are for
diagnostic purposes.
3. Connect the following to your Barracuda Spam Firewall:
16 Barracuda Spam Firewall Administrator’s Guide
•Power cord
•VGA monitor
• PS2 keyboard
After you connect the AC power cord the Barracuda Spam Firewall may power on for a few
seconds and then power off. This is standard behavior.
4. Press the Power button located on the front of the unit
The login prompt for the administrative console is displayed on the monitor, and the light on the
front of the system turns on. For a description of each indicator light, refer to
Indicator Lights on page 34.
APC UPS Support
An APC (American Power Conversion) UPS (Uninterruptible Power Supply) device with a USB
interface is supported with the Barracuda Spam Firewall. No configuration changes are needed on the
Barracuda Spam Firewall to use one. When the APC UPS device is on battery power, the Web-based
administration interface will display an alert, and the Barracuda Spam Firewall will shut down safely
when there is an estimated 3 minutes of battery power remaining.
Configure the System IP Address and Network Settings
Understanding the
The Barracuda Spam Firewall is given a default IP address of 192.168.200.200. You can change this
address by doing either of the following:
• Connect directly to the Barracuda Spam Firewall and specify a new IP address through the
console interface.
• Only on Barracuda Spam Firewall models 200, 300, 400, and 600: Push and hold the Reset
button on the front panel. Holding the
192.168.200.200. Holding the
192.168.1.200. Holding the
To connect directly to the Barracuda Spam Firewall to set a new IP address:
1. At the barracuda login prompt enter admin for the login and admin for the password. The
Reset button for 8 seconds changes the IP address to
Reset button for 12 seconds changes the IP address to 10.1.1.200.
User Confirmation Requested window will display the current IP configuration of the system.
2. Using the Tab key, select Yes to change the IP configuration.
3. Enter the new IP address, netmask, and default gateway for your Barracuda Spam Firewall, and
OK when finished.
select
4. Select No when prompted if you want to change the IP configuration. Upon exiting the screen,
the new IP address and network settings will be applied to the Barracuda Spam Firewall.
Configure your Corporate Firewall
Reset button for 5 seconds changes the IP address to
If your Barracuda Spam Firewall is located behind a corporate firewall, you need to open specific
ports to allow communication between the Barracuda Spam Firewall and remote servers.
Getting Started 17
To configure your corporate firewall:
1. Using the following table as a reference. Open the specified ports on your corporate firewall:
Table 2.1:
Port Direction Protocol Used for...
22 In TCP Remote diagnostics and technical
25 In/Out TCP SMTP
53 Out TCP/UDP Domain Name Server (DNS)
80 Out TCP Virus, firmware and spam rule
123 Out UDP NTP (Network Time Protocol)
2.
If appropriate, change the NAT routing of your corporate firewall to route incoming email to the Barracuda Spam Firewall. Consult your firewall documentation or your corporate firewall administrator to make the necessary changes.
Configure the Barracuda Spam Firewall
sup
port services (recommended)
updates
After specifying the IP address of the system and opening the necessary ports on your firewall, you
need to configure the Barracuda Spam Firewall from the administration interface. Make sure the
computer from which you configure the Barracuda Spam Firewall is connected to the same network,
and the appropriate routing is in place to allow connection to the Barracuda Spam Firewall’s IP
address from a Web browser.
To configure the Barracuda Spam Firewall:
1. From a Web browser, enter the IP address of the Barracuda Spam Firewall followed by port
8000.
Example: http://192.168.200.200:8000
2. Log in to the administration interface by entering admin for the username and admin for the
password.
3. Select Basic > IP Configuration and enter the required information.
The following table describes the fields you need to populate.
Table 2.2:
Fields Description
TCP/IP Configuration The IP address, subnet mask, an
Barracuda Spam Firewall.
TCP port is the port on which the Barracuda Spam Firewall
ceives inbound email. This is usually port 25.
re
d default gateway of your
18 Barracuda Spam Firewall Administrator’s Guide
Table 2.2:
Fields Description
Destination Mail Server TCP/IP
Configuration
DNS Configuration The primary and secondary DNS servers you use on your
Domain Configuration Default Hostname is the hostname to be used in the reply address
The hostname or IP address of your destination email server, for
example mail.yourdomain.com. This is the mail server that
receives email after it has been checked for spam and viruses.
You should specify your mail server’s hostname rather than its IP
address so the destination mail server can be moved and DNS
updated at any time without any changes to the Barracuda Spam
Firewall.
TCP port is the port on which the destination mail server receives
all SMTP traffic such as inbound email. This is usually port 25.
If you need to set up more than one domain or mail server, refer
to Adding New Domains on page 73.
network.
It is strongly recommended that you specify a primary and
secondary DNS server. Certain features of the Barracuda Spam
Firewall, such as a Fake Sender Domain detection, rely on DNS
availability.
for email messages (non-delivery receipts, virus alert
notifications, etc.) sent from the Barracuda Spam Firewall. The
hostname is appended to the default domain.
Default Domain is the domain name to be used in the reply
address for email messages (non-delivery receipts, virus alert
notifications, etc.) sent from the Barracuda Spam Firewall.
Allowed Email Recipients
Domain(s)
4. Click Save Changes.
The domains managed by the Barracuda Spam Firewall. Make
sure this list is complete. The Barracuda Spam Firewall rejects all
incoming messages addresses to domains not in this list.
To allow messages for all domains that match your mail server,
put an asterisk (*) in this field.
Note: One Barracuda Spam Firewall can support multiple
domains and mail servers. If you have multiple mail servers, go to
the DOMAINS tab and enter the mail server associated with each
domain.
If you changed the IP address of your Barracuda Spam Firewall, you are disconnected from the
administration interface and will need to log in again using the new IP address.
Set the Administrative Options
To set the Administrative Options:
1. Select Basic > Administration.
2. Assign a new administration password to the Barracuda Spam Firewall.
Getting Started 19
Set the local time zone. The time on the Barracuda Spam Firewall is automatically updated via
Note
Note
Note
3.
NTP (Network Time Protocol) which requires port 123 to be opened for outbound UDP traffic
on the firewall.
It is important that the time zone be set correctly because this information is used to determine the
delivery times for messages and may appear in certain mail reading programs
4. Click Save Changes.
.
Update the System Firmware
Prior to upgrading the firmware on your Barracuda Spam Firewall, it is always recommended that you
read the release notes.
To upgrade the firmware on the Barracuda Spam Firewall:
1. Select Advanced > Firmware Update.
ALWAYS read the release notes prior to downloading a new firmware version. Release notes
provide you with information on the latest features and fixes provided in the updated firmware
version. You can access the release notes from the
2. Click Download Now and then OK on the download duration window.
Advanced > Firmware Update.
Updating the firmware may take several minutes. Do not turn off the unit during this process. If
the
system has the latest firmware version downloaded, the
3. To see the download progress, click the Refresh button that appears next to the completion
percentage. Once the download has finished, that button will turn into an
The apply process takes several minutes to complete. It is important to not power-cycle the unit
during the download. Inbound and outbound traffic for mail continues when the update process is
complete.
4. Click Apply Now to activate the newly-downloaded firmware. This process will automatically
Download Now button is disabled.
Apply Now button.
reboot your system when completed, which can cause your Web interface to disconnect
momentarily. This is normal and expected behavior, so there is no need to perform a manual
reboot. The Web interface should come back up again within 5 minutes, at which point you will
need to log in again.
Verify your Subscription Status
When you install the Barracuda Spam Firewall, your Energize Updates and Instant Replacement
subscriptions are active. It is important you verify the subscription status so your Barracuda Spam
20 Barracuda Spam Firewall Administrator’s Guide
Firewall receives the latest virus and spam updates from Barracuda Central. The Energize Update
Click to activate your
subscription
Note
service is responsible for downloading these virus and spam definitions to your system.
To check your subscription status:
1. Select Basic > Status.
2. In the Subscription Status section, verify the word Current appears next to Energize Updates and
Replacement Service (if purchased).
The following graphic shows t
Figure 2.1:
he location of the Subscription Status section.
3. If the status of your subscription is Not Activated, do the following:
3a. Click the activate link as shown in the following example. This opens the product
activation page.
3b. On the product activation page, fill in the required fields and click Activate. A
confirmation page opens that displays the terms of your subscription.
3c. After a couple minutes, click Refresh in the Subscription Status section of the Basic >
Status page. The status of your subscriptions should now be displayed as Current.
If your subscription status does not change to Current, or if you have trouble filling out the product
activation page, call Barracuda Networks at 1-888-ANTISPAM and ask for a sales representative.
Getting Started 21
Route Incoming Email to the Barracuda Spam Firewall
Note
The next step in setting up your Barracuda Spam Firewall is to route incoming email to the system so
it can scan incoming messages for spam and viruses. You can use either of the following methods to
route messages to your Barracuda Spam Firewall:
• Port forw
arding is used when the Barracuda Spam Firewall is behind a corporate firewall
running NAT (Network Address Translation)
• MX r
ecords are used when your Barracuda Spam Firewall is located in a DMZ with a routable
public IP address
Do not try to route outgoing email through the Barracuda Spam Firewall unless you have
configured the Relay operation or are using the Barracuda Spam Firewall in outbound mode.
After you route incoming email to the Barracuda Spam Firewall, it will start filtering all emails it
receives and route the good email to your email server.
Port Forwarding
When your Barracuda Spam Firewall is behind a corporate firewall, you need to do a port redirection
(also called port forwarding) of incoming SMTP traffic (port 25) to the Barracuda Spam Firewall.
For more information about port forwarding, refer to your firewall documentation or administrator.
MX Records
If your Barracuda Spam Firewall is in the DMZ (not protected by your corporate firewall), do the
following to route incoming messages to the system:
1. Create a DNS entry for your Barracuda Spam Firewall.
The following example sh
ows a DNS entry for a Barracuda Spam Firewall with a name of
barracuda and an IP address of 66.233.233.88:
barracuda.yourdomain.com IN A 66.233.233.88
2. Change your DNS MX Records.
The following example
IN MX 10 barracuda.yourdomain.com
shows the associated MX record with a priority number of 10:
Tune the Default Spam Settings
After you install the Barracuda Spam Firewall, the system begins filtering incoming email based on
the default settings. For example, the unit automatically checks incoming email for viruses and uses
the Barracuda blacklist service to identify spam.
Initially, your Barracuda Spam Firewall is configured to tag most spam by adding the word “[BULK]”
to the subject line of messages. Once you have more experience with the Barracuda Spam Firewall
22 Barracuda Spam Firewall Administrator’s Guide
you can adjust how aggressively the system deals with spam. For example, you may decide to
quarantine spam instead of blocking it.
The following table describes the most common tasks you should perform when first tuning your
system.
Table 2.3: Tuning Tasks
Task Refer to
Monitor and Classify Incoming Emails Classifying Messages on page 36
Verify the Spam Scoring Defaults Configuring the Global Spam Scoring Limits on page 40
Set Up Quarantine (optional) Setting Up Quarantine Policies on page 43
Block Messages from Specific IP
Addresses, Domains or Email Accounts
Chapter 4 Using the Block and Accept Filters
Configuring Basic Scanning of Outgoing Mail (Hybrid mode)
The Barracuda Spam Firewall can be configured to fully process either incoming or outgoing email,
but a Barracuda Spam Firewall in inbound mode may also be configured to relay outgoing email
simultaneously. Outgoing email is scanned, but not as thoroughly as incoming email. The following
checks are performed on outgoing email when in hybrid mode: RBL, rate control, whitelist/blacklist,
virus scan, fingerprinting, and regular expressions that cause the email to be blocked.
Configuring the Barracuda Spam Firewall in this way will increase the load on the system. You may
find that you need to upgrade your system.
To configure your Barracuda Spam Firewall to perform virus checking and limited spam scanning on
outgoing mail, and/or append footers to outgoing mail, enable the “Outbound Relay” feature as
described in Setting up your Email Server as a Smart/Relay Host on page 27 and Setting up Trusted
Relays and SASL/SMTP Authentication on page 102. Outbound messages will not be tagged or
quarantined.
If you want to use this Barracuda Spam Firewall for checking only outgoing email, refer to
Configuring your System for Outbound Mode on page 33.
Getting Started 23
Installation Examples
This section provides example installation scenarios you can reference to help determine the best way
to integrate the Barracuda Spam Firewall into your network environment.
Barracuda Spam Firewall Behind Corporate Firewall
The figure below shows the Barracuda Spam Firewall behind your corporate firewall. In this example,
the Mail Server has an IP address of 10.10.10.2 and the Barracuda Spam Firewall has an IP address
of 10.10.10.3.
Figure 2.2:
In this type of setup, perform the following tasks:
• Forward (port redirection) incoming SMTP traffic on port 25 to the Barracuda Spam Firewall at
10.10.10.3.
• Configure the Barracuda Spam Firewall to forward filtered messages to the destination mail
server at 10.10.10.2.
There is no need to modify any MX records for this type of setup.
24 Barracuda Spam Firewall Administrator’s Guide
Barracuda Spam Firewall in the DMZ
The figure below shows the Barracuda Spam Firewall in front of your corporate firewall in the DMZ.
In this example, the Mail Server has an IP address of 10.10.10.2 and the Barracuda Spam Firewall has
a public IP address of 64.5.5.5.
Figure 2.3:
In this type of setup, perform the following tasks:
• Assign an available external IP address to the Barracuda Spam Firewall.
• Change the MX (Mail Exchange) records on the DNS (Domain Name Server) to direct traffic
towards the Barracuda Spam Firewall. Create an A record and MX record on your DNS for the
Barracuda.
The following example shows a DNS entry for a Barracuda Spam Firewall with a name of
barracuda and an IP address of 64.5.5.5.
barracuda.yourdomain.com IN A 64.5.5.5
The following example shows the associated MX record with a priority number of 10:
IN MX 10 barracuda.yourdomain.com
Getting Started 25
Operating Modes
The Barracuda Spam Firewall supports two operating modes:
• Inbound Mode (default) scans all incoming messages for viruses, custom policy, and spam
probability to ensure that all email delivered to your users is virus-free and legitimate. In
inbound mode, the Barracuda Spam Firewall also supports basic outbound mail scanning
through the "Outbound Relay" tab for companies who simply need to perform virus checking,
limited spam scanning capabilities, and appending of footers to outgoing mail. By default,
Barracuda Spam Firewalls are configured for inbound mode when shipped
• Outbound Mode offers more advanced capabilities that include custom outbound mail policy,
more comprehensive outbound spam scanning techniques, and outbound quarantine workflows
for postmasters or compliance officers to sideline mail that violates policy. More advanced
email applications may require deployment of separate Barracuda Spam Firewalls dedicated to
inbound and outbound mail scanning.
Changing the Operating Mode to Outbound
A Barracuda Spam Firewall can only be configured for one mode. If you choose to change the mode
from inbound to outbound, note the following:
• All your system message log data and quarantine messages are deleted.
• System configuration remains intact. However, you should verify that the configuration options
are appropriate for outbound mode.
To change the mode of your Barracuda Spam Firewall:
1. Select Basic > Administration.
2. In the Operating Mode section, click Convert.
3. Click OK to confirm you want to change the mode of your Barracuda Spam Firewall. A status
bar displays the progress of switching your Barracuda Spam Firewall to outbound mode. Once
the switchover is complete, your Barracuda Spam Firewall automatically reboots.
Basic Configuration
After the system reboots, log onto the Barracuda Spam Firewall and review the changes to the user
interface.
1. Select Basic > IP Configuration.
2. Verify the IP address, subnet mask, and default gateway of your Barracuda Spam Firewall in the
TCP/IP Configuration section. The TCP port is the port in which the Barracuda Spam Firewall
receives inbound email. The default is port 25.
3. Review the DNS servers in your network in the DNS Configuration section. Certain features of
the Barracuda Spam Firewall, such as a Fake Sender Domain detection, rely on DNS
availability.
4. Verify that the Hostname and Domain Name are correct in the Domain Configuration section.
This is the hostname used for email messages (non-delivery receipts, virus alerts notifications,
etc.) sent from the Barracuda Spam Firewall.
5. If you have made any changes to the configuration, click Save Changes.
26 Barracuda Spam Firewall Administrator’s Guide
Setting up your Email Server as a Smart/Relay Host
The last step in setting up your Barracuda Spam Firewall for outbound mode is to configure your
internal mail server to deliver all outgoing messages to the Barracuda Spam Firewall before those
messages are sent out. This is done by setting up your email server as a smart/relay host.
The following Web sites provide instructions on how to set up specific mail servers as a smart/relay
host. For additional information, consult your email server administrator and documentation.
Table 2.4: Email Server Types
E-mail Server Refer to...
Microsoft Exchange Server 200x http://support.microsoft.com/kb/265293
Novell Groupwise Server http://www.novell.com/documentation/gw55/index.html?pag
e=/documentation/gw55/gw55ia/data/a2zi22h.html
Lotus Domino Server http://www-
12.lotus.com/ldd/doc/domino_notes/Rnext/help6_admin.nsf/f
4b82fbb75e942a6852566ac0037f284/14cdfeaa188fa90a85
256c1d003955af?OpenDocument
Enable Smart Host
To enable Smart Host:
1. Connect to your internal Mail Server
2. Open the System Manager (usually located on the Desktop)
3. Select Admin Groups > First Admin Group > Servers > Cuda-Server > Protocols > SMTP
4. Right-click on the Default SMTP Connector and choose Properties
5. Click on the Delivery Tab
6. Click on the Advanced button
7. Enter the IP address of the Barracuda Spam Firewall in the Smart Host field surrounded by []
8. Click OK
9. Click OK again to exit
10. Repeat steps 3 through 8 for the remaining SMTP Connectors (ST1 - ST6)
Disable Smart Host
To disable Smart Host:
1. Connect to your internal Mail Server
2. Open the System Manager (usually located on the Desktop)
3. Select Admin Groups -> First Admin Group -> Servers -> Cuda-Server -> Protocols -> SMTP
4. Right-click on the Default SMTP Connector and choose Properties
5. Click on the Delivery Tab
6. Click on the Advanced button
7. Remove any contents found under Smart Host
8. Click on OK
9. Click on OK again to exit
Getting Started 27
10. Repeat steps 3 through 8 for the remaining SMTP Connectors (ST1 - ST6)
Changing Outbound to Inbound Mode
A Barracuda Spam Firewall can only be configured for one mode. When you change the mode from
Outbound-only back to Inbound, note the following:
• Your message log data and quarantine messages are deleted.
• The system configuration remains intact. However, you will need to verify that the configuration
options are appropriate for inbound mode.
If you wish to scan both inbound and outbound messages, then you can run your Barracuda Spam
Firewall in a hybrid mode, which is inbound mode with the “Outbound Relay” feature turned on. This
“basic outbound” mode will allow basic virus scanning only of all outgoing messages, in addition to
complete spam and virus scanning of all inbound messages.
To change the mode of your Barracuda Spam Firewall:
1. Select Basic > Administration.
2. In the Operating Mode section, click Convert.
3. Click OK to confirm you want to change the mode of your Barracuda Spam Firewall. A status
bar displays the progress of switching your Barracuda Spam Firewall to inbound mode. Once
the switchover is complete, your Barracuda Spam Firewall automatically reboots.
Basic Configuration
After the system reboots, log onto the Barracuda Spam Firewall and review the changes to the user
interface.
1. Select Basic > IP Configuration.
2. Verify the IP address, subnet mask, and default gateway of your Barracuda Spam Firewall in the
TCP/IP Configuration section. The TCP port is the port in which the Barracuda Spam Firewall
receives inbound email. The default is port 25.
3. Review the DNS servers in your network in the DNS Configuration section. Certain features of
the Barracuda Spam Firewall, such as a Fake Sender Domain detection, rely on DNS
availability.
4. Verify that the Hostname and Domain Name are correct in the Domain Configuration section.
This is the hostname used for email messages (non-delivery receipts, virus alerts notifications,
etc.) sent from the Barracuda Spam Firewall.
5. Make sure that the Allowed Email Recipients Domain lists all the domains managed by the
Barracuda Spam Firewall. The Barracuda Spam Firewall rejects all incoming message addresses
to domains not on the list.
6. If you make any changes to the configuration, click Save Changes.
Review the Administration Options
1. Select Basic > Administration.
2. Verify the options on this page and make necessary changes.
28 Barracuda Spam Firewall Administrator’s Guide
3. If you make any changes to the configuration, click Save Changes.
Setting up Basic Outbound
In order to make your Barracuda Spam Firewall perform virus checking and limited spam scanning,
and append footers to outgoing mail, configure inbound mode and enable the “Outbound Relay”
feature as described in Setting up your Email Server as a Smart/Relay Host on page 27 and Setting up
Trusted Relays and SASL/SMTP Authentication on page 102. Note that this mode will not tag or
quarantine any outbound messages.
Route Incoming and Outgoing Email to the Barracuda Spam Firewall
The final step in setting up a Barracuda Spam Firewall is to route both incoming and outgoing email
to the system so that it can scan incoming messages for spam and viruses. For more details, please
see Route Incoming Email to the Barracuda Spam Firewall on page 22.
Getting Started 29
30 Barracuda Spam Firewall Administrator’s Guide
Loading...