2.3. Email Anti-Virus


2.3.1. Overview

Email Anti-Virus is a service that detects and/or blocks viruses that invade via E-mail (SMTP communication).
This service is used via the SIGs. You need to apply separately for Service Interconnectivity.

2.3.2. Features

The following features are available for Email-Anti-Virus.
Feature Overview
Virus Scan
A feature that monitors E-mail (SMTP communication), and executes specified action when viruses are detected.
The target protocol of this service is SMTP.

You can select one of the following actions.
Items Overview
Allow Allows communications without logging.
Alert
Monitors email (SMTP), and detects viruses.
However, traffic is not blocked even though viruses are detected. Logs detection status.
Block
Monitors email (SMTP), and detects viruses.
Note that communication is blocked when viruses are detected, and the SMTP Reply Code: 541 is returned to the sender. Logs blocking status.

Analysis Capacity

  • Maximum traffic volume: 200 Mbps in total of both directions/service
  • Maximum simultaneous connections: 40,000 sessions/service
Note 1: The above values are best-effort.
Note 2: you can increase the traffic volume up to 1 Gbps, 200,000 sessions (when 5 services used) by applying additional services. When you need the additional service, please contact us in advance.

2.3.3. Restrictions

Restrictions relating to IP addresses

  • In order to connect the SIGs with Email-Anti-Virus, you must have two IP address blocks available. If the IP address block is already being used, NTT Com Group might ask you to change it.
  • NTT Com Group will manage the assigned IP address blocks, and assign IP addresses to the devices that require them.
Restrictions relating to network configuration

  • If you perform Ping monitoring on the VM, you will require an additional Server Segment for direct connection between vFW/INA and the VM.
  • Do not connect the target server segments directly to the vFW/INA.
Other restrictions

  • When the actual traffic volume exceeds the contracted traffic volume, the excess traffic might be discarded.

  • The following files are not targeted for Virus Scan.

    • Encrypted files
    • Password-protected files
    • Files compressed by compression algorism other than zip/gzip
    • Files compressed three (3) times or more
  • Packets which break TCP/UDP/IP protocol rules or abnormal packets are discarded as a standard function regardless of customer’s configuration.
    (Examples)
    • When the IP header is cut off in the middle
    • When the Port number is 0 (zero)
    • When the TCP flag combination is abnormal and others
  • If devices making up this feature are replaced due to malfunction etc., you will not be able to check device logs or event reports from prior to the replacement via Security Web Portal. In addition, if the active server and the standby server are switched for a redundantly configured device and they are restored without replacing the device, you cannot check the log or the event reports of the period during which the switching occurred from Security Web Portal.

  • Email-Anti-Virus does not guarantee that the Email-Anti-Virus feature has integrity or accuracy, or is suitable for your use. Furthermore, the suitability of the virus identification algorithms provided by the developers or distributors of the devices making up the Email-Anti-Virus feature is not guaranteed.

  • The following information might be provided to the developers or distributors of the devices making up the Email-Anti-Virus feature.

    • Configuration information obtained from providing Email-Anti-Virus
    • Information concerning inspections etc., for Email-Anti-Virus
  • We cannot guarantee recovery from failures that might occur due to incompatibility between Email-Anti-Virus and your environment, or failures that occur due to your operations other than those specified by NTT Com group.