Watchguard SMTP proxy quarantine specific attachments [feature request?]

schwarzenbekschwarzenbek
in Firebox - Proxies

Hello everyone,

we are using a SMTP proxy rule for all incoming mails. I would like to send specific mail attachments directly to the Watchguard Quaratine Server. But there is no available action for that. It is only possible to set the action to "AV Scan" and in the Gateway AV settings I can set the action to "Quaratine" when a virus is detected for example.

But I would like to quaratine all macro enabled excel files without relying on the Gateway AV. As a workaround I am currently using the action "lock", so the file needs to be unlocked by the unlock.exe from the WSM directory. But it would be much easier for my team to just use the Quaratine Client to handle these kind of attachments.

Is there a reason why this is not possible? I think it would be a good feature.

Comments

  • james.carsonjames.carson Moderator, WatchGuard Representative

    Hi @schwarzenbek

    The files that have macros are generally too large or the proxy has detected a macro when the file has already started transmitting which causes this issue.

    -James Carson
    WatchGuard Customer Support

Sign In to comment.