How to block the emails from particular domain or email address using App rules.

How To block the emails from particular domain or email address using App rules.

Resolution for SonicOS 7.X

This release includes significant user interface changes and many new features that are different from the SonicOS 6.5 and earlier firmware. The below resolution is for customers using SonicOS 7.X firmware.

To block emails from domains, follow the following steps.

 
Step 1: Create a Match object for a domain to be blocked.

1.Click Object in the top navigation menu.
2. Navigate to Match object | Match Objects, Click on Add and Match Object

3. In the new window that has opened, enter the following options

• Enter the "Object Name: "
• From the drop down of "Match Object Type" select "Email From"
• Choose the "Match Type" as "Partial Match"
• Content:  *Enter the domain that you need to block *                                                                                                       

Step 2 : Create App Rules policy

1. Navigate to the Policies | Rules & Policies  | App Rules page.

2. Enable the App Rules by clicking on the Gear Icon and checking the box Enable App Rules.

3. Click on the Add New Policy  button to open the Edit App Control Policy window.
4. Enter the following information and click on OK.                                                                                               

Once we click on OK, We will see the policy as below

Testing

When we get emails from an address which has .click we will see log messages under
  1. Click Monitor in the top navigation menu.
  2.  Navigate to Logs | System logs , to see log messages.

Resolution for SonicOS 6.5

This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.

Step 1: Create a Match object for a domain to be blocked.

1.Click Manage in the top navigation menu.
2. Navigate to Policies | Objects | Match Objects ,Click on Add and Match Object

  
3. In the new window that has opened, enter the following options

• Enter the "Object Name: "
• From the drop down of "Match Object Type" select "Email From"
• Choose the "Match Type" as "Partial Match"
• Content:  *Enter the domain that you need to block *

 
 
Step 2 : Create App Rules policy

1. Navigate to the Policies | Rules  | Application Rules page.

 
2. Enable the Application Rules by clicking on the Gear Icon and checking the box Enable App Rules.

 
3. Click on the Add New Policy  button to open the Edit App Control Policy window.
4. Enter the following information and click on OK.

Once we click on OK, We will see the policy as below
 
Testing

When we get emails from an address which has .click we will see log messages under
  1. Click Investigate in the top navigation menu.
  2.  Navigate to Logs | Event Logs , to see log messages.

Resolution for SonicOS 6.2 and Below

The below resolution is for customers using SonicOS 6.2 and earlier firmware. For firewalls that are generation 6 and newer we suggest to upgrade to the latest general release of SonicOS 6.5 firmware.

Create a Match object for a domain to be blocked.

1.Go to Firewall | Match Objects ,Click on Add New Match Object again to open the Add/Edit Match Object window.
2. Enter a name for the match object.
3. Select Email From under Match Object Type
4. Select Match Type as Partial
5. Set Input Representation as Alphanumeric
6. Under Content, enter the extension of the domain,Example: .Click
7. Click on Add after each entry.
8. Click on OK to save.

Create App Rules policy

1. Navigate to the Firewall | App Rules page.
2. Enable the check-box Enable App Rules.
3. Click on the Add New Policy  button to open the Edit App Control Policy window.
4. Enter the following information and click on OK.

Once we click on OK, We will see the policy as below

Testing

When we get emails from an address which has .click, the following messages will be logged under Log | View: