Outbound Message Filtering
Any message sent through the Barracuda Spam & Virus Firewall addressed to a domain that is configured on the appliance is treated as an inbound message. All others are treated as outbound messages. All Barracuda Spam & Virus Firewall models include essential outbound mail filtering

Introduction 11

techniques that help organizations to ensure that all outgoing email is legitimate and virus-free. Quarantine of outbound messagses can be managed at the per-domain level as well as at the global level, and every outbound email message passes through the following layers: Rate Control Virus Scanning Custom Policies Spam Fingerprint Analysis Intent Analysis Image Analysis Rule-based Spam Scoring
See Outbound Configuration, p. 59 for configuring outbound mail filtering.
Energize Updates Maximize Protection

Barracuda Central

To provide your organization with maximum protection against the latest types of spam and virus attacks, engineers at Barracuda Central monitor the Internet for trends in spam and virus attacks, collecting data from worldwide collection points. These updates are then automatically updated around the clock to your Barracuda Spam & Virus Firewall via the Energize Updates feature.
Figure 1.2: Constant Updates to Barracuda Central
By identifying spam and virus trends at an early stage, the team at Barracuda Central can quickly develop new and improved blocking techniques that are automatically made available to your Barracuda Spam & Virus Firewall.
Energize Updates provide your Barracuda Spam & Virus Firewall with the following benefits: Barracuda Reputation (see Barracuda IP Reputation (BBL), p. 51) Spam definitions Security definitions Virus definitions Access to the latest firmware
Figure 1.3: Energize Updates from Barracuda Central Delivers New Spam and Virus Definitions
How Energize Updates Defeat Spam
The Barracuda Spam & Virus Firewall scrutinizes all the characteristics of a message and uses a complex system of scores to determine whether or not a message is spam. When an email reaches the spam scoring filter, the Barracuda Spam & Virus Firewall assigns scores to all the properties of the message. For example, the Barracuda Spam & Virus Firewall scrutinizes: A messages header and subject line for offensive characters or words The percentage of HTML in the message Whether a message contains an unsubscribe link These properties (along with many others) help the Barracuda Spam & Virus Firewall to determine the spam score for a message that youll see displayed on the Message Log page of the Web interface. By default, Energize Updates are set to automatically keep the spam rules and scores up-to-date so that the Barracuda Spam & Virus Firewall can quickly counteract evolving techniques used by spammers.

Bayesian Analysis

Bayesian Analysis applies only to inbound mail and is a linguistic algorithm that profiles language used in both spam messages and legitimate email for any particular user or organization. To determine the likelihood that a new email message is spam, Bayesian Analysis compares the words and phrases used in the new email against the corpus of previously identified email. The Barracuda Spam & Virus Firewall only uses Bayesian Analysis after administrators or users profile a corpus of at least 200 legitimate (not spam) messages and 200 spam messages. Bayesian Analysis does not apply to outbound mail.

Spam Scoring

Once an inbound or outbound message has passed the initial Barracuda Spam & Virus Firewall block/accept filters, it receives a score for its spam probability. This score ranges from 0 (definitely not spam) to 9 or greater (definitely spam). Based on this score, the Barracuda Spam & Virus Firewall can take one of the following actions: Block Quarantine Tag (inbound mail only) Allow (inbound mail only) Send (outbound mail only)
Domain Level Spam Scoring: The Barracuda Spam & Virus Firewall 400 and higher allows for setting spam score levels for inbound mail at the domain level. The administrator or the Domain admin role can set the spam scoring levels on the BASIC > Spam Checking page. Per-User Spam Scoring: The Barracuda Spam & Virus Firewall 600 and higher allows the administrator to enable users to set their own spam score levels for inbound mail if per-user quarantine
22 Barracuda Spam & Virus Firewall Administrators Guide
is enabled. If per-user spam scoring is enabled, when the user logs into their account, they will see the PREFERENCES > Spam Settings page from which they can set tag, quarantine and block scoring levels for that account.
Barracuda Spam & Virus Firewall Concepts 23
Predictive Sender Profiling
When spammers try to hide their identities, the Barracuda Spam & Virus Firewall can use Predictive Sender Profiling to identify behaviors of all senders and apply the applicable Barracuda Spam & Virus Firewall defense tactic to reject connections and/or messages from spammers. This involves looking beyond the reputation of the apparent sender of a message, just like a bank needs to look beyond the reputation of a valid credit card holder of a card that is lost or stolen and used for fraud. Some examples of spammer behavior that attempts to hide behind a valid domain, and the Barracuda Spam & Virus Firewall features that address them, include the following: Sending too many emails from a single network address Automated spam software can be used to send large amounts of email from a single mail server. The Rate Control feature on the Barracuda Spam & Virus Firewall can be set to limit the number of connections made from any IP address within a 30 minute time period. Violations are logged to identify spammers. Rate Control is configured from the BLOCK/ACCEPT > Rate Control page. The Messages Per SMTP Session setting limits the number of messages allowed in one SMTP session. If the number of messages in one session exceeds this threshold, the rest of the messages are temporarily blocked and are displayed in the message log as being "Deferred" with "Per-Connection Message Limit Exceeded" as the reason for the postponement. The sender is required to make a new connection to continue sending messages, which may ultimately trigger a Rate Control deferral. For this and other SMTP security settings, see the ADVANCED > Email Protocol page. Attempting to send to too many invalid recipients Many spammers attack email infrastructures by harvesting email addresses. Recipient Verification on the Barracuda Spam & Virus Firewall enables the system to automatically reject SMTP connection attempts from email senders that attempt to send to too many invalid recipients, a behavior indicative of directory harvest or dictionary attacks. Using LDAP lookup or a local database to verify valid recipients as well as Sender Spoof Protection, which blocks email with "From" addresses which use an allowed recipient domain on the Barracuda Spam & Virus Firewall, protects against receiving mail targeted to invalid recipients. Registering new domains for spam campaigns Because registering new domain names is fast and inexpensive, many spammers switch domain names used in a campaign and send blast emails on the first day of domain registration. Realtime Intent Analysis on the Barracuda Spam & Virus Firewall is typically used for new domain names and involves performing DNS lookups and comparing DNS configuration of new domains against the DNS configurations of known spammer domains. Using free Internet services to redirect to known spam domains Use of free Web sites to redirect to known spammer Web sites is a growing practice used by spammers to hide or obfuscate their identity from mail scanning techniques such as Intent Analysis. With Multilevel Intent Analysis, the Barracuda Spam & Virus Firewall inspects the results of Web queries to URIs of well-known free Web sites for redirections to known spammer sites.

Getting Started 33

The following example shows a DNS entry for a Barracuda Spam & Virus Firewall with a name of barracuda and an IP address of 66.233.233.88:
barracuda.yourdomain.com IN A 66.233.233.88
2. Change your DNS MX Records. The following example shows the associated MX record with a priority number of 10:
You can configure specific SMTP settings from the ADVANCED > Email Protocol page. After you route incoming email to the Barracuda Spam & Virus Firewall, it will begin filtering all email it receives and routing good email to your mail server.
Configure Scanning of Outgoing Mail
The Barracuda Spam & Virus Firewall may be configured to scan outgoing mail simultaneously with scanning inbound mail. Virus Scanning and Rate Control are applied to outbound mail as well as the following filters, if specifically enabled, which are configurable from the BASIC > Spam Checking and BLOCK/ACCEPT pages: Spam Scoring, with Block or Quarantine actions IP Filtering Content Filtering (Subject, Header and Body) Attachment Filtering Fingerprint Analysis Image Analysis Intent Analysis
The following scanning tools are not applied to outbound mail: IP Reputation, a sender authentication mechanism SPF (Sender Policy Framework), a sender authentication mechanism DKIM (DomainKeys), an email authentication system designed to verify the DNS domain of an email sender Regional Settings, the application of special spam analysis rules for particular languages Per-user Whitelist/Blacklist Per-domain Whitelist/Blacklist
To scan outgoing mail with the Barracuda Spam & Virus Firewall, you must configure outbound operation on the BASIC > Outbound page. There youll specify the outbound SMTP server or Smart host if you have one, the trusted mail server IP address or domain name (either your mail server or another trusted relay) and, optionally, an authentication type. The Barracuda Spam & Virus Firewall supports SMTP/SASL authentication and LDAP. If you are relaying though a Smart host, you must also configure the Smart host to send to the Internet. Be aware that configuring the Barracuda Spam & Virus Firewall to scan outbound as well as inbound mail will increase the load on the system. You may find that you need to upgrade your Barracuda Spam & Virus Firewall to another model.
Outbound Message Footer - Global or Domain-level
The Barracuda Spam & Virus Firewall can append a custom text and/or html footer to each outbound message, configurable at the global level on the ADVANCED > Outbound Footers page. You can also opt to exclude certain email senders from having the outbound footer appended to their outgoing messages. To enable or disable an outbound message footer for a specific domain, effectively overriding the global setting, navigate to the DOMAINS page, click Manage for the domain and navigate to the ADVANCED > Outbound Footers page.

BASIC > Spam Checking page as well as on various BLOCK/ACCEPT pages. If enabled, you can
select either Global quarantine or Per-User quarantine. For more information, refer to Chapter 8, Managing Inbound Quarantine, p. 75. Quarantine of outbound mail can be enabled or disabled in the Outbound Spam Scoring Limits section on the BASIC > Spam Checking page, as well as on various BLOCK/ACCEPT pages, and outbound quarantined mail can be logged and managed at the per-domain level as well as at the global level. For more information on using outbound quarantine, see Spam Filtering and Quarantine of Outbound Mail, page 60.

Getting Started 41

Chapter 4 Securing the Barracuda Spam & Virus Firewall
This chapter covers best practices to secure your Barracuda Spam & Virus Firewall with respect to deployment on your network, user access and inbound and outbound email. The following topics are covered: Securing Network Access.. 44 Limiting User Access... 45 Advanced Email Security Policy... 46
Securing the Barracuda Spam & Virus Firewall 43

Securing Network Access

To secure your Barracuda Spam & Virus Firewall on your network, begin by locking down the user interface ports. Barracuda Networks recommends using the non-standard port 8000 for internal access to the Web interface, which is configured on the BASIC > Administration page. From that page you can also further limit access to the Web interface by IP address with the Administrator/IP Range setting. If no IP address is specified in this field, then all systems are granted access with the correct administrator password. You can secure external access to the Barracuda Spam & Virus Firewall with the Web Interface HTTPS/SSL Port setting on the ADVANCED > Secure Administration page. The recommended port is 443 because it is a standard HTTPS/SSL port that is used for secure Web browser communication, and the identity of the remotely connected server can be verified with significant confidence.
If per-user quarantine is enabled as well as HTTPS, users will be redirected to HTTP access if they are trying to access their quarantine inbox.

SSL Certificates

As described above, limiting user interface access to HTTPS provides further security and can also be configured on the ADVANCED > Secure Administration page along with the use of SSL certificates. There are three types of SSL certificates to choose from: Default (Barracuda Networks), Private (self-signed) or Trusted certificate - a certificate signed by a trusted certificate authority (CA). Configuring SSL certificates is described in this guide in the Enabling SSL for Administrators and Users, page 37 section of the Getting Started chapter as well as in the online help of the ADVANCED > Secure Administration page

60 Barracuda Spam & Virus Firewall Administrators Guide
Sender Based Rate Control, including specifying email addresses you wish to exempt, is configured on the BLOCK/ACCEPT > Rate Control page.
IP Analysis of Outbound Mail
After applying rate controls, the Barracuda Spam & Virus Firewall performs analysis on the IP address, applying quarantine or block policies that you configure in the BLOCK/ACCEPT pages.
BLOCK/ACCEPT policies created at the per-domain level do NOT apply to outbound messages. So, for example, navigating to the DOMAINS page, then clicking Manage Domain for a particular domain, then configuring policies on the BLOCK/ACCEPT pages ONLY applies to inbound
messages for that domain.
Once the true sender of an outbound email message is identified, the intent of that sender should be determined before accepting the message as valid, or not spam. The best practice is to know the IP addresses of trusted senders and forwarders of email and define those on the Barracuda Spam & Virus Firewall as Allowed by adding them to a whitelist of known good senders. Various methods for discerning good senders of email versus spammers are described in this section to help you to quickly configure your Barracuda Spam & Virus Firewall per the needs of your organization.
The Barracuda Spam & Virus Firewall does a reverse DNS lookup on inbound and outbound IP connections and finds the hostname associated with the IP address of the sender. By configuring rules on the BLOCK/ACCEPT > Reverse DNS page, you can choose to apply common reverse DNS rules by country or create custom rules to quarantine or block outbound messages from those domains. The last part of a hostname is known as the top level domain, or TLD. Most TLDs include a country identifier, such as.ca for Canada,.ru for Russia, etc. If most or all of the mail that you receive from a particular country is spam, you can use the Common Reverse DNS Rules to tag (inbound only), block or quarantine any message that has an associated hostname that includes that country's TLD. Email which is not blocked is subject to all of the usual spam and virus checks. Use the Custom Reverse DNS Rules to quarantine or block outbound messages from hostnames ending with values that you specify. List the sending domains or subdomains you want to whitelist on the BLOCK/ACCEPT > Sender Domain page.
Outbound Configuration 61
Content Analysis - Outbound
Custom content filtering based on the subject line, message headers, message body and attachment file type can be applied to outbound mail just as it can be to inbound mail. See the filtering pages on the BLOCK/ACCEPT tab for details on settings. Note that for content filters, the action drop-downs list Block, Quarantine, Off for outbound mail. Tagging messages suspected to be spam is only available for inbound mail. The online help for the BLOCK/ACCEPT > Content Filters page includes a link to a Regular Expressions help page that covers text patterns you can use for advanced filtering. Note that HTML comments and tags imbedded between characters in the HTML source of a message are filtered out so content filtering applies to the actual words as they appear when viewed in a Web browser.

Remote Administration

Barracuda Networks provides a set of APIs for remote administration and configuration of the Barracuda Spam & Virus Firewall, firmware version 4.x. The APIs work through manipulation of variables inside of the system configuration database, and anything that can be declared in that database can be set or checked with the APIs. This includes most things that you can set by clicking the Save Changes button in the Barracuda Spam & Virus Firewall Web interface. For example, from the BASIC > Spam Checking page, you can set global Spam Scoring Limit values for the actions Block, Tag or Quarantine, then click the Save Changes button. These values can be set remotely using the APIs. The framework of the API provides for the programmer to get or set variables inside an XML-RPC request that correspond to field values in the configuration database in the Barracuda Spam & Virus Firewall. Some languages such as Perl, for example, provide wrappers for XML-RPC requests, providing an interface to form the request. To view the variables and current settings of the Barracuda Spam & Firewall configuration database, on the ADVANCED > Backup page, select System Configuration for Backup Type and click the Backup button. To prepare the Barracuda Spam & Virus Firewall for use with the APIs, you must first enter the IP addresses that are allowed to communicate with the APIs in the Allowed SNMP and API IP/Range field on the BASIC > Administration page, and you must create an API Password that will be included with all calls to the APIs. For more information on using the APIs, see the Barracuda Spam & Virus Firewall API Guide 4.x on the Barracuda Web site: http://www.barracuda.com/support.
Advanced Configuration 73
Chapter 8 Managing Inbound Quarantine
The Barracuda Spam & Virus Firewall provides a fully featured, robust quarantine function to apply at either a global level or at a per-user level, configurable for each domain managed by the appliance. This chapter covers some pros and cons of enabling quarantine and how and why to use global or peruser quarantine. How Quarantine of Inbound Mail Works.. 76 Quarantine Options... 76 Using Global Quarantine... 77 Using Per-user Quarantine... 77

Setting up Alerts

Setting up Emailed System Alerts
The BASIC > Administration page allows you to configure the Barracuda Spam & Virus Firewall to automatically email system notifications and alerts to the email address(es) you specify. To enter multiple addresses, separate each address with a comma. Note that notifications are queued separately from outbound messages. System alerts are sent from the Barracuda Spam & Virus Firewall to the System Alerts Email Address(es) you specify when a system issue triggers an automated alert, including: LDAP lookup or server errors. This alert email is sent once per day reporting LDAP errors logged over the past 24 hours. A few errors may not be indicative of a problem, but more than a few may mean that there is mail that is being blocked for one or more invalid recipients. Failure of an automated backup. The email will indicate the cause of failure, such as, for example, the backup server is not available, invalid username or invalid password. Check the settings on the ADVANCED > Backup page in the Automated Backups section.
Notifications are sent from Barracuda Central to the System Contact Email Address when: Your Energize Update subscription is about to expire Problems arise with RAID disk storage New security bulletins are available
Setting up SNMP Query and Alerts
While the Barracuda Spam & Virus Firewall will send email alerts to the System Alerts Email Address specified on the BASIC > Administration page, these alerts are limited and do not include latency, inqueue sizes, and other similar information. To monitor more specific information on a Barracuda Spam & Virus Firewall, Barracuda Networks recommends using SNMP monitoring with an SNMP server. The Barracuda Spam & Virus Firewall 400 and higher offers the ability to monitor various settings via SNMP, including: System statistics, such as: > inbound queue size > outbound queue size > average email latency > appliance uptime The subscription status of Energize Updates and, if applicable, Instant Replacement and Premium Support. Performance statistics, including mail/log storage, CPU temperature and system load.
To query the Barracuda Spam & Virus Firewall for these statistics via SNMP, you must first enter the IP address of the server that will be making the SNMP connection in the Allowed SNMP and API IP/Range section of the BASIC > Administration page. IP addresses entered in that field are allowed to access the Barracuda via SNMP queries to retrieve error information, or via the API to configure the device.
Monitoring the System 101
For details about configuring SNMP with the Barracuda Spam & Virus Firewall, see the technical paper SNMP Monitoring for the Barracuda Spam & Virus Firewall 4.x at http://www.barracudanetworks.com/documentation

Applying a new firmware version results in a temporary loss of service. For this reason, you should apply new firmware versions during non-busy hours. Before upgrading, BE SURE TO TAKE THE Barracuda Spam & Virus Firewall OFFLINE. This will ensure that the inbound mail queue is emptied and all messages are scanned before the upgrade process begins. DO NOT MANUALLY REBOOT YOUR SYSTEM at any time during an upgrade, unless otherwise instructed by Barracuda Networks Technical Support.
The current firmware version shows in the top section of the page, with the latest General Release version of the firmware shown below in the Firmware Download section. To download the latest firmware version, click the Download Now button. The Web interface will display download progress. When the firmware download is complete, click the Apply Now button. The Barracuda Spam & Virus Firewall will reboot and you will need to log in again to the Web interface.
Updating the Definitions from Energize Updates
This should be one of the steps the administrator performs in the initial installation of the Barracuda Spam & Virus Firewall.The ADVANCED > Energize Updates page allows you to manually update the Virus, Policy, and Document Definitions used on your Barracuda Spam & Virus Firewall, as well as change the interval at which the system checks for updates. We recommend that the Automatic Update option be set to On for all three types of definitions so that your Barracuda Spam & Virus Firewall receives the latest rules as soon as they are made available by Barracuda Networks.
Barracuda Spam & Virus Firewall Adminstrators Guide
Backing up and Restoring Your System
Three Types of Backups Available
The ADVANCED > Backup page lets you back up and restore three kinds of backup files for your Barracuda Spam & Virus Firewall: System configuration Bayesian databases - global and per-user (if your model supports per-user) Explicit Users to Accept For and Alias Linking data
You should back up your system on a regular basis in case you need to restore this information on a replacement Barracuda Spam & Virus Firewall or in the event that your current system data becomes corrupt. To prepare the system for backing up, first configure your backup server information, then select which, if not all, backups you want to create, and, if desired, a schedule of automated backups on the ADVANCED > Backup page. If you are restoring a backup file on a new Barracuda Spam & Virus Firewall that is not configured, you first need to assign your new system an IP address and DNS information on the BASIC > IP Configuration page of the new system. Note the following about the backup files: Do not edit backup files. Any configuration changes you want to make need to be done through the Web interface. The configuration backup file contains a checksum that prevents the file from being uploaded to the system if any changes are made. You can safely view a backup file in Windows WordPad or TextPad. You should avoid viewing backup files in Windows Notepad because the file can become corrupted if you save the file from this application. Information not backed up with the system configuration file includes system password, system IP information, DNS information and clustering settings. For a complete list of settings that are not backed up, please see the online help of the ADVANCED > Backup page.

Limited Warranty and License 121
Restricted Rights. Barracuda Networks' commercial software and commercial computer software documentation is provided to United States Government agencies in accordance with the terms of this Agreement, and per subparagraph "(c)" of the "Commercial Computer Software - Restricted Rights" clause at FAR 52.227-19 (June 1987). For DOD agencies, the restrictions set forth in the "Technical Data-Commercial Items" clause at DFARS 252.227-7015 (Nov 1995) shall also apply. No Warranty. The Energize Update Software is provided AS IS. Customer's sole and exclusive remedy and the entire liability of Barracuda Networks under this Energize Update Software License Agreement will be, at Barracuda Networks option, repair, replacement, or refund of the Energize Update Software. Renewal. At the end of the Energize Update Service Period, Customer may have the option to renew the Energize Update Service at the current list price, provided such Energize Update Service is available. All initial subscriptions commence at the time of sale of the unit and all renewals commence at the expiration of the previous valid subscription. In no event does Barracuda Networks warrant that the Energize Update Software is error free or that Customer will be able to operate the Energize Update Software without problems or interruptions. In addition, due to the continual development of new techniques for intruding upon and attacking networks, Barracuda Networks does not warrant that the Energize Update Software or any equipment, system or network on which the Energize Update Software is used will be free of vulnerability to intrusion or attack. DISCLAIMER OF WARRANTY. ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS, AND WARRANTIES INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTY OR CONDITION OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, SATISFACTORY QUALITY OR ARISING FROM A COURSE OF DEALING, LAW, USAGE, OR TRADE PRACTICE, ARE HEREBY EXCLUDED TO THE EXTENT ALLOWED BY APPLICABLE LAW. TO THE EXTENT AN IMPLIED WARRANTY CANNOT BE EXCLUDED, SUCH WARRANTY IS LIMITED IN DURATION TO THE WARRANTY PERIOD. BECAUSE SOME STATES OR JURISDICTIONS DO NOT ALLOW LIMITATIONS ON HOW LONG AN IMPLIED WARRANTY LASTS, THE ABOVE LIMITATION MAY NOT APPLY TO YOU. THIS WARRANTY GIVES YOU SPECIFIC LEGAL RIGHTS, AND YOU MAY ALSO HAVE OTHER RIGHTS WHICH VARY FROM JURISDICTION TO JURISDICTION. General Terms Applicable to the Energize Update Software License Disclaimer of Liabilities. IN NO EVENT WILL BARRACUDA NETWORKS BE LIABLE FOR ANY LOST REVENUE, PROFIT, OR DATA, OR FOR SPECIAL, INDIRECT, CONSEQUENTIAL, INCIDENTAL, OR PUNITIVE DAMAGES HOWEVER CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY ARISING OUT OF THE USE OF OR INABILITY TO USE THE ENERGIZE UPDATE SOFTWARE EVEN IF BARRACUDA NETWORKS OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. In no event shall Barracuda Networks' liability to Customer, whether in contract, tort (including negligence), or otherwise, exceed the price paid by Customer. BECAUSE SOME STATES OR JURISDICTIONS DO NOT ALLOW LIMITATION OR EXCLUSION OF CONSEQUENTIAL OR INCIDENTAL DAMAGES, THE ABOVE LIMITATION MAY NOT APPLY TO YOU. This Energize Update Software License shall be governed by and construed in accordance with the laws of the State of California, without reference to principles of conflict of laws, provided that for Customers located in a member state of the European Union, Norway or Switzerland, English law shall apply. The United Nations Convention on the International Sale of Goods shall not apply. If any portion hereof is found to be void or unenforceable, the remaining provisions of the Energize Update Software License shall remain in full force and effect. Except as expressly provided herein, the Energize Update Software License constitutes the entire agreement between the parties with respect to the license of the Energize Update Software and supersedes any conflicting or additional terms contained in the purchase order.

"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any

Limited Warranty and License 127
other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
Source Code Availability Per the GPL and other "open source" license agreements the complete machine readable source code for programs covered by the GPL or other "open source" license agreements is available from Barracuda Networks at no charge. If you would like a copy of the source code or the changes to a particular program we will gladly provide them, on a CD, for a fee of $100.00. This fee is to pay for the time for a Barracuda Networks engineer to assemble the changes and source code, create the media, package the media, and mail the media. Please send a check payable in USA funds and include the program name. We will mail the packaged source code for any program covered under the GPL or other "open source" license.

Account creation automatic 86 disabling 86 manually, by administrators 87 manually, by users 87 Advanced networking topics 72 alerts backup failures 101 emailed 101 LDAP errors 101 SNMP 101 system 101 Alias Linking 69, 79 All_domains permissions assigning 91 Domain Admin 94 Helpdesk 92 allowed email recipient domains 31 API for remote configuration of the Barracuda Spam & Virus Firewall 85 Attachment blocking, notifications of 40 attachment filtering inbound 53 outbound 62 Authentication LDAP, POP, RADIUS 45 single sign on 45
Bounce messages, sending or not 72 Bounce suppression 47, 66
Certificate generation 37 Classify incoming emails 39 clustering the Barracuda Spam & Virus Firewall data not synchronized across the cluster 71 limiting user access to a clustered system 46 setting up clustered systems 69 configuration reloading 110 Configure 30 content filtering inbound mail 53 outbound mail 62 pre-made patterns 53
daily mail statistics 98 definitions, updating 33, 108 diagnostic memory test 113 Disk space, managing 81 DNS configuration 31 Domain Admin account role 94 domain configuration, default for the Barracuda Spam & Virus Firewall 31 domain level settings accessing 84 and quarantine 84 list of 35
Backscatter, Reducing 73 Backup Bayesian database 109 configuration database 109 errors and alerts 101 Explicit Users to Accept For list 109 Barracuda Central 10 Bayesian learning classifying messages 39 getting the best accuracy 56 how it works 55 when to use it 56 block score 39

Index - 129

email routing incoming 33 Email Statistics inbound 40 outbound 40 Energize Updates 108 Ethernet interfaces 72
failed system, replacing 113 Firewall, locating the Barracuda Spam & Virus Firewall in your network 26 Firmware update 108 Front panel indicator lights 106
Notifications default language 81 for blocked attachments 40 for outbound quarantined messages 60 of quarantined messages 80 System Alerts Email Address 101 System Contact Email Address 101
hardware compliance 115 hardware test 113 Helpdesk account role 92 Hostname, default used in reply address 31 hourly mail statistics 98
Online Help 10 Outbound Relay with LDAP authentication 47 Outbound relay configuring 34, 46
indicator lights 106 Initial 30 Instant Replacement Service 113 Invalid Bounce Suppression 66 IP address, initial setting 29
Performance statistics 40 Permissions, user-level 80 POP 45 POP authentication 45 Port Forwarding 72 post-installation tasks 38 Preferences, enabling users to edit 88 Private (self-signed) certificates 37
Language blocking email by country 54 Non-delivery reports (NDRs) 73 notifications 81 Web Interface, selecting 36 LDAP authentication 45 LDAP errors alerts email 101 LEDs (on front panel) 106 Load Balancer in Direct Server Return Mode, configuring for
Quarantine disabling 77 domain level settings 84 global 77 inbox 79, 80 notifications 80 outbound mail 60 setting up 41 where quarantined messages go 78 Queue inbound and outbound messages 98

Logging in administrator login 30 new account credentials 87 Loopback Adaptor 72
RADIUS authentication 45 RAID disk storage alerts when problems arise 101 and Barracuda Spam & Virus Firewall models 14 status indicator on BASIC > Status page 98 rate control inbound mail 50 outbound mail 60 reboot options 112 Recipient Verification 68 recovery mode 112 re-imaging the system 113 reloading the system 110 remote administration 113
mail statistics 40, 98 Mail syslog 100 memory test 113 Message Log 39, 100 Models of the Barracuda Spam & Virus Firewall 14 monitoring tasks 97 MX records 33
network interfaces, configuring 73 network settings, initial configuration 29 Non-Delivery Reports (NDRs) 72
Replacement Service (Instant) 113 replacing a failed system 113 Reporting 103 Requeuing outbound messages 99 RESET button 110 restarting the system 110 Restoring a backup 109 Retention Policy inbound messages 76 outbound messages 60 Retry button retrying delivery of outbound messages 98 Role-based Administration 84 Roles Domain Admin 94 Helpdesk 92 User 91 Routing Email 33 routing incoming email 33
tag score 38 Task Manager, using to monitor system tasks 104 TCP ports 30 technical support, contacting 15 time zone 36 TLS encryption 46 Troubleshooting tools 111 Trusted (signed by a trusted CA) certificates 37 Trusted Forwarder 67
UDP ports 30 Updating definitions 108 firmware 108 UPS Support 29 User Access, Limiting 45 User account role 91 User accounts enabling features 87 User Features, Default 79 User Login Activities tracking with syslog 45
Securing user access with single sign on 45 Sender Policy Framework (SPF) 67 shutting down the system 110 Single Sign On newly created accounts 87 user authentication 45 SMTP Encryption 46 SNMP query and alerts 101 spam scoring configuring via the API 44 domain level settings 36, 85 initial settings 38 outbound mail 60 overview 13 per-user settings 35 SSL certificates, generating 37 Static Routes 72 Statistics email 40 performance 40 Storage of email, minimizing 81 Syslog mail syslog 100 tracking changes to the configuration 45 using a syslog server for monitoring 105 system alerts 101 reboot 110 shutdown 110 System Alerts Email Address 101 System Contact Email Address 101

Virtual Appliance Setup Guide
Barracuda Spam & Virus Firewall Vx
The Barracuda Spam & Virus Firewall Vx Virtual Appliance includes the same powerful technology and simple Web based user interface found on the Barracuda Spam & Virus Firewall hardware appliance. It is designed for easy deployment on VMware infrastructure and can be combined with other Barracuda Networks hardware appliances. The virtual appliance is a good option for standardizing hardware platforms or for deploying a Barracuda Spam & Virus Firewall solution in an existing virtual environment. As the organization grows, it can be scaled for performance and capacity and also provides for quick backup and disaster recovery. The Barracuda Spam & Virus Firewall Vx supports version 4.1 and higher of the Barracuda Spam & Virus Firewall firmware. Before downloading and installing your Barracuda Spam & Virus Firewall Vx, make sure you have the following in place: A configured server running the VMware ESXi server version 3.5, Update 2, or higher on which you will install the Barracuda Spam & Virus Firewall Vx. The VMware vSphere client installed on your local machine. 6 GB of free space on your VM client (local) machine if you are using the ZIP download method of getting the virtual machine image as described below.
Installing the Virtual Appliance Image
From the Virtual Machines Downloads Web page, there are two methods for obtaining the virtual appliance image for the Barracuda Spam & Virus Firewall Vx: Method 1: Download the Open Virtual Machine Format (OVF) Template from Barracuda Central by copying and pasting the URL from the Virtual Machines Downloads page into your VM client. This method is more convenient, but requires the bandwidth to download the entire virtual appliance image once for each installation of the virtual appliance. If you are only going to download one virtual appliance / product, this method is suggested. Method 2: Download the ZIP archive of the OVF Template directly from the Virtual Machines Downloads page (Figure 2). If you are going to deploy multiple Barracuda Network virtual appliances, this method will save time and bandwidth by only downloading once. You can simply re-use the same ZIP file for each virtual appliance installation.
Installation Method 1: Download the OVF Template from Barracuda Central
1. Log in to your VM vSphere client. 2. From your VM vSphere client interface, select the File > Deploy OVF Template option to create the virtual appliance. 3. Select Deploy by URL and copy and paste the URL from the Virtual Machines Downloads page as shown in Figure 1.
Copyright 2004-2011, Barracuda Networks Inc. V1.x-110301-05-0307

Page 1 of 6

Figure 1.
Virtual Machines Downloads page for getting the virtual appliance image
4. Read and accept the license agreement. 5. Give the virtual appliance a name, such as, for example, Library Spam & Virus Firewall. 6. In your VM vSphere client, choose a data store to use for your Barracuda Spam & Virus Firewall Vx virtual appliance. 7. Review the options youve selected before clicking Finish to start the deployment task. The task could take awhile as the product image downloads. 8. When you see the Deployment Complete window, close it, and you should see your new virtual appliance listed by the name you gave it in the left sidebar of the VM vSphere client. 9. After installation, if desired, you can Edit Settings by right clicking on the virtual appliance to configure memory, number of virtual processors and other settings before starting it.
Installation Method 2: Download the ZIP archive of the OVF Template
1. From the Virtual Machines Downloads page click on the link for the zip file for the product image. Downloading the image could take a few minutes.

Figure 2.

Click on the ZIP archive to download the product image
2. Unzip the ZIP archive, which contains the following files, on your system: The OVF template, which is an.ovf file. THIS is the file you will import to your VM client in step 5 below. The product image, which is a.vmdk file A checksum file (.mf) A README file and additional notes as applicable End-User License Agreement 3. Log in to your VM vSphere client.

Page 2 of 6

4. From your VM vSphere client interface, select the File > Deploy OVF Template option to create the virtual appliance. 5. Select Deploy from file and click the Browse button to locate the OVF template (the.ovf file) you unpacked from the ZIP archive on your local file system or network. 6. Read and accept the license agreement. 7. Give your virtual appliance a name that will easily identify it in your VM vSphere Client, for example: Library Spam & Virus Firewall Firewall. 8. In your VM vSphere client, choose a data store to use for your Barracuda Spam & Virus Firewall Vx virtual appliance. 9. Review the options youve selected before clicking Finish to start the deployment task. 10. After installation, if desired, you can Edit Settings by right clicking your virtual appliance in the left pane of the VM vSphere client to configure memory, number of virtual processors and other settings before starting it.
Configuring the Virtual Appliance Template
1. Once the virtual appliance is downloaded to your VM Client, you can click on it to select it, then click the Run icon or menu option to run the virtual appliance. 2. Once your virtual appliance is running, click the Console tab to use the console configuration utility. Youll see the system starting up, which could take a minute or two. Log in with the username admin and a password of admin. NOTE: Your mouse will be captured by the VM client; press <ctrl><alt> to see your mouse again on the screen. 3. When you see the System Configuration screen, using your keyboard arrow keys, arrow down to 'TCP/IP Configuration' and set the IP address, netmask, gateway, and DNS addresses for this appliance. Arrow down to Save and hit Enter to commit the change. 4. Arrow down to Licensing, hit Enter and key in your license using the token from the Customer Services email message you received from Barracuda Networks. Enter the default domain you want to use for this virtual appliance. 5. Arrow down to Save and hit Enter to commit the change.

Opening Firewall Ports

If your Barracuda Spam & Virus Firewall Vx is located behind a corporate firewall, open the following ports on your firewall to ensure proper operation: Port Direction In/Out Out Out Out TCP Yes Yes Yes No UDP No Yes No Yes Usage Email and email bounces Domain Name Service (DNS) Virus, firmware and spam rule updates** Network Time Protocol (NTP)

Logging into the Barracuda Spam & Virus Firewall Vx Web interface
Once the virtual appliance has been configured, visit the virtual appliance Web interface and use it like any other Barracuda Networks product. You can access the appliance by entering the following URL in your browser, replacing <MyVxIPaddress> with the IP address you entered in the console configuration utility above: http://<MyVxIPaddress>:8000

Page 3 of 6

Verify the configuration by following these steps: 1. Log into the Barracuda Spam & Virus Firewall Vx Web interface as the administrator. Use Username: admin Password: admin 2. Go to the BasicIP Configuration page and perform the following: 1. Verify that the IP Address, Subnet Mask, and Default Gateway are correct. 2. Enter the Server Name/IP of your destination email server where you want the Barracuda to deliver mail. For example, type: mail.<yourdomainname>.com 3. Verify that the Primary and Secondary DNS Server are correct. 4. Enter Default Hostname and Default Domain. This is the name that will be associated with bounced messages. For example, enter barracuda as the Default Hostname and <yourdomain.com> as the Default Domain. 5. Under Allowed Email Recipient Domain(s), enter each domain for which the Barracuda will receive email. Click Add after each domain entry. Note: The Barracuda will reject all incoming email addressed to domains not specified here. 3. Click any one of the Save Changes buttons to save all of the information.

Update the Firmware

Click on the AdvancedFirmware Update page. If there is a new Latest General Release available, perform the following steps to update the system firmware: 1. Click on the Download Now button located next to the firmware version that you wish to install. To view download progress, click on the Refresh button. When the download is complete, the Refresh button will be replaced by an Apply Now button. 2. Click on the Apply Now button to install the firmware. This will take a few minutes to complete. 3. After the firmware has been applied, the Barracuda Spam & Virus Firewall Vx will automatically reboot, displaying the login page when the system has come back up. 4. Log back into the Web interface again and read the Release Notes to learn about enhancements and new features. It is also good practice to verify settings you may have already entered, as new features may have been included with the firmware update.

Change the Administrator Password
To avoid unauthorized use, we recommend you change the default administrator password to a more secure password. You can only change the administrator password for the Web interface. Go to BasicAdministration and enter your old and new passwords, then click on Save Password.
Route Email to the Barracuda Spam & Virus Firewall
To take advantage of the spam and virus filtering features of the Barracuda Spam & Virus Firewall Vx, you must route all incoming email to the virtual appliance. There are two common options for routing email to the Barracuda Spam & Virus Firewall Vx: Port Forwarding. Change the port forwarding settings on your corporate firewall to route incoming email to your Barracuda Spam & Virus Firewall Vx. To do this, modify your corporate firewall port settings as required. For instructions, see your firewall documentation or administrator. MX Records. Create a DNS entry for your Barracuda Spam & Virus Firewall Vx and change
Copyright 2004-2011, Barracuda Networks Inc. V1.x-110301-05-0307 Page 4 of 6
your DNS MX record to route incoming email to the Barracuda. Typically, this is done at your DNS server or through your DNS service. Example: DNS Entry for Barracuda Spam & Virus Firewall barracuda.barracudanetworks.com Example: Modified MX Record IN MX 10 IN A 66.233.233.88
barracuda.barracudanetworks.com
Although DNS programs and services vary, your new DNS and MX entries should resemble the examples above. The above example shows a priority of 10, for illustration only. Note: some DNS servers cache information for up to 7 days, so it may take time for your email to be routed to the new MX record.

Outgoing Email

Do not try to route outgoing email through the Barracuda Spam & Virus Firewall Vx unless you have configured Outbound Relay operation on the ADVANCED Outbound page.
Tuning your Spam Controls
Initially your Barracuda Spam & Virus Firewall Vx is configured to Tag most spam. The subject line of the spam messages will be prepended with the word [BULK]. This allows user configuration of email client programs to put the messages into a separate folder. You can adjust the aggressiveness of the spam scoring algorithm at any time. These changes can easily be made on the Basic Spam Scoring page. We recommend using an initial configuration that does only tagging. After you have some familiarity and see how email is being tagged, you can adjust the configuration to suit your needs.

Best Practices for Configuring your VMware vSphere Client
Barracuda Networks recommends the following for best configuration of your VM client running the Barracuda Spam & Virus Firewall Vx: 1. Allocate 1 GB of RAM for the virtual appliance per CPU allocated and 40 GB of available hard disk space. 2. You will need only a single virtual NIC on your virtual appliance. Most likely you will want to use the 'bridged' networking setup on VMware.
Note: VMware tools are not needed for Barracuda Networks virtual appliances (they mostly have to do with graphical interface characteristics for virtual desktop OSs). Online help is available by clicking the Help icon on any page of the product Web interface. The Barracuda Spam & Virus Firewall Vx Administrators guide covers concepts and advanced topics for administering the product and can be found on the Barracuda Networks Web site at
http://www.barracuda.com/documentation

Page 5 of 6

Backing Up Your Barracuda Virtual Appliance System State
Virtual machine environments generally provide a "snapshot" capability, which captures the state of a system as it's running. Once a snapshot is created, you can perform additional operations on the system and "revert" to the snapshot in the case of disaster recovery (or for any other reason). Because this feature is so powerful, Barracuda Networks very strongly recommends performing a snapshot at certain points in time: 1. Before upgrading the Barracuda Virtual Appliance firmware. 2. Before making major changes to your configuration (this makes snapshotting a convenient "undo" mechanism). 3. After completing and confirming a large set of changes, such as initial configuration. 4. As a periodic backup mechanism. Barracuda Networks also strongly recommends that you review your virtual environment documentation regarding snapshotting capabilities and be familiar with their features and limitations.

Page 6 of 6