Fortinet FortiGate Series Administration Guide

Replacement messages System Config
FortiGate Version 4.0 MR1 Administration Guide
254 01-410-89802-20090903
http://docs.fortinet.com/ • Feedback
Mail replacement messages
The FortiGate unit sends the mail replacement messages listed in Table 29 to email
clients and servers using IMAP, POP3, or SMTP when an event occurs such as antivirus
blocking a file attached to an email that contains a virus. Email replacement messages are
text messages.
If the FortiGate unit supports SSL content scanning and inspection these replacement
messages can also be added to IMAPS, POP3S, and SMTPS email messages.
HTTP replacement messages
The FortiGate unit sends the HTTP replacement messages listed in Table 30 to web
browsers using the HTTP protocol when an event occurs such as antivirus blocking a file
that contains a virus in an HTTP session. HTTP replacement messages are HTML pages.
If the FortiGate unit supports SSL content scanning and inspection and if Protocol
Recognition > HTTPS Content Filtering Mode is set to Deep Scan in the protection profile,
these replacement messages can also replace web pages downloaded using the HTTPS
protocol.
Table 29: Mail replacement messages
Message name Description
Virus message Antivirus Virus Scan enabled for an email protocol in a protection profile deletes
a infected file from an email message and replaces the file with this message.
File block
message
When the antivirus File Filter enabled for an email protocol in a protection profile
deletes a file that matches an entry in the selected file filter list, the file is blocked
and the email is replaced with this message.
Oversized file
message
When the antivirus Oversized File/Email is set to Block for an email protocol in a
protection profile and removes an oversized file from an email message, the file
is replaced with this message.
Fragmented
email
In a protection profile, antivirus Pass Fragmented Emails is not enabled so a
fragmented email is blocked. This message replaces the first fragment of the
fragmented email.
Data leak
prevention
message
In a DLP sensor, a rule with action set to Block replaces a blocked email
message with this message.
Subject of data
leak prevention
message
This message is added to the subject field of all email messages replaced by the
DLP sensor Block, Ban, Ban Sender, Quarantine IP address, and Quarantine
interface actions.
Banned by data
leak prevention
message
In a DLP sensor, a rule with action set to Ban replaces a blocked email message
with this message. This message also replaces any additional email messages
that the banned user sends until they are removed from the banned user list.
Sender banned
by data leak
prevention
message
In a DLP sensor, a rule with action set to Ban Sender replaces a blocked email
message with this message. This message also replaces any additional email
messages that the banned user sends until the user is removed from the banned
user list.
Virus message
(splice mode)
Splice mode is enabled and the antivirus system detects a virus in an SMTP
email message. The FortiGate unit aborts the SMTP session and returns a 554
SMTP error message to the sender that includes this replacement message.
File block
message (splice
mode)
Splice mode is enabled and the antivirus file filter deleted a file from an SMTP
email message. The FortiGate unit aborts the SMTP session and returns a 554
SMTP error message to the sender that includes this replacement message.
Oversized file
message (splice
mode)
Splice mode is enabled and antivirus Oversized File/Email set to Block and the
FortiGate unit blocks an oversize SMTP email message. The FortiGate unit
aborts the SMTP session and returns a 554 SMTP error message to the sender
that includes this replacement message.

Fortinet FortiGate Series Specifications

General

Brand	Fortinet
Model	FortiGate Series
Category	Firewall
Language	English