Products this article apply to: All Forefront Server products, all Antigen Server products

Customers will be able to take advantage of these new enhancements and engine changes after deploying the Antigen service packs released on July 1, 2009: Antigen 9 with SP2.

What does this mean? Any Antigen 9 installation using SpamCure must be upgraded to the latest version of Antigen (Antigen 9 with SP2) before the 1st of December to be able to switch to Cloudmark.

At the moment of writing (2^nd of October) Antigen 9 with SP2 is the latest update, it already integrates the antispam engine Cloudmark.

Please review “Forefront server Security Engine revision FAQ” on the Engine Revision Overview and FAQ for more information.

In order to find out more details about what's happening, we first need to create diagnostics logging in Forefront. See below how to enable diagnostics logging

- Create following DWORD registry value, and set the value to 4:

  Path: [HKLM\Software\Wow6432Node\Microsoft\Forefront Server Security\Office Communications Server]

  Name: "DiagnosticLoggingLevel"

- Go to SETTINGSàGeneral Options in the Forefront Administrator UI and enable the “Additional IM” setting.

The following error pattern might be logged in the Forefront Programlog.txt (…\Microsoft Forefront Security\Office Communications Server\Data):

Tue Aug 18 09:18:21 2009 ( 4028-    7), "DIAGNOSTIC: Processing request | StandardMethod[Message] Method[MESSAGE] Call-ID[89a1897355c64d36b441631dbf203f8e] CSeq[3 MESSAGE] |"

Tue Aug 18 09:18:42 2009 ( 4028-    7), "EXCEPTION: ForefrontRTCProxy.exe.RtcProcessingWorkFlows.InterceptAndScanThread("<System.Object fsoTransactionObj>") - Exception setting up downloader for outbound connection to 10.242.0.91:6892" The system returned the following exception: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 10.242.0.91:6892

Tue Aug 18 09:18:42 2009 ( 4028-    7), "ERROR: ForefrontRTCProxy.exe.RtcProcessingWorkFlows.InterceptAndScanThread("<System.Object fsoTransactionObj>") - Failed to establish connection to file transfer sender."

Tue Aug 18 09:18:42 2009 ( 4028-    7), "DIAGNOSTIC: Terminated | StandardMethod[Message] Method[MESSAGE] Call-ID[89a1897355c64d36b441631dbf203f8e] CSeq[3 MESSAGE] |"

A network trace could indicate that the OCS server was trying to establish a connection on port 6892 to the client, but the client did not respond in any  of these connection attempts to complete the TCP hand-shake:

9:18:20 AM 8/18/2009    393    3007571212    ForefrontRTCProxy.exe    {TCP:31, IPv4:3}    10.145.2.83    10.242.0.91    4538 (0x11BA)    6892 (0x1AEC)    TCP    TCP:Flags=......S., SrcPort=4538, DstPort=6892, PayloadLen=0, Seq=3007571212, Ack=0, Win=64240 (  ) = 64240

9:18:23 AM 8/18/2009    487    3007571212    ForefrontRTCProxy.exe    {TCP:31, IPv4:3}    10.145.2.83    10.242.0.91    4538 (0x11BA)    6892 (0x1AEC)    TCP    TCP:[SynReTransmit #393]Flags=......S., SrcPort=4538, DstPort=6892, PayloadLen=0, Seq=3007571212, Ack=0, Win=64240 (  ) = 64240

9:18:29 AM 8/18/2009    705    3007571212    ForefrontRTCProxy.exe    {TCP:31, IPv4:3}    10.145.2.83    10.242.0.91    4538 (0x11BA)    6892 (0x1AEC)    TCP    TCP:[SynReTransmit #393]Flags=......S., SrcPort=4538, DstPort=6892, PayloadLen=0, Seq=3007571212, Ack=0, Win=64240 (  ) = 64240

You can use a tool such as Microsoft’s Network Monitor to create a network trace. This tool is easy to use, even if you’re new to it. Simply use the play and stop buttons to record/stop recording network traffic.

First we need to understand that the port range used to transfer files between 2 OCS clients is 6891 – 6900. Communication over these ports is only initiated when file transfers are taking place. That’s why running "netstat –nao" will only reveal which port Forefront is using, while the file transfer is in progress. Two minutes after the file transfer is completed, this port will be closed again.

So in order for file transfers to be successful, we need to ensure that the client machine is able to accept inbound connections on port range 6891 – 6900. In this example, the local firewall on the client machine was configured to block all incoming connections from the OCS server. Once the firewall rules were changed to allow this traffic, file transfers worked as expected between clients (via the Forefront for OCS server).

After resolving the issue, make sure to disable diagnostics logging again. See below how to enable diagnostics logging

- Edit following DWORD registry value, and set the value to 0:

  Path: [HKLM\Software\Wow6432Node\Microsoft\Forefront Server Security\Office Communications Server]

  Name: "DiagnosticLoggingLevel"

- Go to SETTINGSàGeneral Options in the Forefront Administrator UI and disable the “Additional IM” setting.

Kind regards,

Paul Gruner

Security Support Engineer

Applies to:

Microsoft Forefront Security for Office Communications Server, Version: 10.2.0308.0 and above.

It’s come to our attention recently that Spamhaus has phased out the old SBL-XBL list, which has now been replaced by the ZEN list (named after a guard dog).

Here’s a comparison of the currently available Spamhaus lists (source: www.spamhaus.org):

So, what does this mean for you as an administrator of Antigen?

If you’re already using Spamhaus as a RBL list in some way, you need to decide whether to use only the ZEN list, or a combination of the SBL, XBL and PBL lists. Really, if you are happy with blocking the content of all 3 lists, it makes sense to go with Spamhaus’ recommendation of using just the ZEN list. This will improve your lookup responses, as you’ll only need to make one lookup per mail, rather than a potentially 3 lookups (one per SBL, XBL and PBL list).

You should also delete any SBL-XBL list that you have enabled (sbl-xbl.spamhaus.org), since it is no longer in use. This is important to do; otherwise it can cause delays while Antigen is waiting for the corresponding RBL lookup to come back.

Note that Spamhaus provides a free service to smaller customers only. Before using Spamhaus as a RBL service within Antigen, please check to see if you qualify for free usage on the Spamhaus DNSBL Usage page. Otherwise you’ll have to get yer wallet out...

Cheers,

Andy Day

Microsoft CSS (Customer Service and Support)

To backtrack a bit, the programlog.txt is the most used and most important of all of the Antigen/Forefront Server logs. It lives in the \Data subfolder of any Forefront Server installation and in the main installation folder for Antigen for Exchange/SMTP. It is essentially a kind of extended event log for Antigen/Forefront only. It’s critical that information can be written to this log, since if something goes wrong this is the first point of reference for troubleshooting (at least amongst CSS engineers).

Getting back to the problem...I was troubleshooting a customer issue the other day and found that I could not get the Transport Diagnostics to work at all (in Forefront for Exchange). No DIAGNOSTICS:  entries were being written to programlog.txt as they should have been.

In the end, it turned out that the processes trying to write to the programlog (instances of FSCTransportScanner.exe) were running under the Network Service (this is normal for these processes), which in turn did not have write access to the Program Files (x86)\Forefront Server Security directory, nor its subfolders/files. Once the Network Service was granted write access to this directory (and permissions were inherited by all subfolders/files), Forefront was able to write DIAGNOSTICS:  (and other) entries to the programlog.

Checking the account for FSCTransportScanner.exe in Task Manager

In the above screenshot, the FSCTransportScanner.exe process is running under the Network Service.

Adding the Network Service with Write access to the Forefront install directory

If you are experiencing the issue and do not see the account that runs the process with the above permissions, add it.

So, if you ever do notice that the programlog (or other Antigen/Forefront files) have stopped logging, or seem to be missing some information, check that the User Names under which Antigen/Forefront Server processes are running do have write access to files in the install directory and subfolders/files. Task Manager is a quick way to do this.

Easy when you know how...hopefully this will save some time for one of ye in the future.

Cheers,

Andy Day

Microsoft CSS (Customer Service and Support)

some weeks ago I dealt with a request that took me quite sometimes and lots of tests, I thought I should share this on our blog as to save someone´s head hake.

The request was: I want to set a File Filter to prevent Standard Users from sending or receiving any BMP attachment. I also have the Managers who should not be restricted by this filter, that is, Managers should be able to send and receive any file”.

Now, there are some points to be aware of in Forefront for Exchange (FSE):

-          Unlike Antigen, in FSE there´s only one RealTime Scan Job. You can choose which mailboxes the RealTime scan job should apply to.

-          All mails, even between users on the same Storage Group, will go through a Hub server (and therefore a Transport Scan Job).

-          “…After scanning each message on the Exchange 2007 Transport role, FSE applies a secure antivirus stamp. This prevents duplicate scanning on the Mailbox server role when the message is deposited into the Store…” (see Ex_Best_Practices.doc )

We first took these steps:

-          We created a File Filter to block all files called “*” on the Real Time Scan Job , where “File Types” is “BMP”

be aware that we didn’t create any File Filter at the Transport Scan Job level, otherwise we wouldn’t be able to differentiate between standard users and Managers.

-          We also, disabled Virus Scanning and Content Filtering from the Real Time Scan Job (in Operate/Run Job), so that Real Time Scan Job would only check for File Filtering.

-          We then applied the Real Time Scan Job to  Standard Users, and made sure Managers were excluded (in Settings/ScanJob, highlight  Realtime Scan Job, under Mailboxes check Selected, hit the icon…

…and choose which users the scan job should apply to.

What we achieved with these was:

-          Managers were able to send and receive BMP files (AS REQUESTED)

-          Standard users could not send any BMP file (AS REQUESTED*)

-          All users (both Managers and Standard Users) could receive incoming mail with any attachment (NOT AS REQUESTED).

By analyzing the logs we noticed that messages were scanned and Stamped at the SMTP level, then once in the mailbox server no Real Time Scan Job was performed.

-          In order for the Real Time Scan Job to be performed, and File Filtering be applied  we had to set the registry key DisableAVStamping to 1 (see Ex_Best_Practices.doc )

DisableAVStamping [registry]

After scanning each message on the Exchange 2007 Transport role, FSE applies a secure antivirus stamp. This prevents duplicate scanning on the Mailbox server role when the message is deposited into the Store.

It is recommended that you use the secure antivirus transport stamp as designed. You should turn it off only if you plan to use different engines or filtering settings on the Transport server and the Mailbox server. Otherwise, needless duplicate scanning occurs.

The "DisableAVStamping" registry key permits you to override the recommended default setting. This causes the Transport stamp to be suppressed, and the Mailbox server to treat the message as not having been previously scanned.

To override the default, add a new DWORD, called "DisableAVStamping" with a value of "1". This value is not present by default and is assumed to be "0" (the default).

FSE stores registry values in the following locations:

For 32-bit systems:

·      HKLM\SOFTWARE\Microsoft\Forefront Server Security\Exchange Server

For 64-bit systems:

·      HKLM\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server

After that we managed to achieve what we wanted.

Final consideration: this filter would add some extra load on the mail box server, which is what the FSE design tries to avoid, performing all scanning at the Transport Scan Job,

however as it is just a File Filter the additional scan load is not so great, and this solution allowed us to achieve both our goals.

* Be aware that a mail may or may not be scanned by the Realtime scanjob, depending on the load on the server (especially on busy servers). This is behaviour is due to race conditions. The impact of race conditions is beyond the scope of this blog article. Maybe I’ll save that for another time J.

Regards

Fulvio Spanedda

Senior Support Engineer Antigen/Forefront

Microsoft CSS Security

Note: This blog targets current, fully released Antigen and Forefront server products (FSE, FSSP, FSOCS and Antigen 9). It does not cover older, legacy Antigen products, or the future Forefront product wave that is code-named ‘Stirling’.

To start with, here’s a table that shows possible and recommended engine update methods for common scenarios:

	Options
Scenario	Direct HTTP	UNC Hub	FSSMC	UNC+Manual download
1-2 Antigen/Forefront servers	Recommended	Possible	Possible	Last Resort!
Multiple servers, multiple sites	Possible	Possible	Recommended (1 FSSMC server per site, per 2000 managed servers)	Last Resort!
Antigen for SMTP / Forefront Edge servers in a DMZ	Recommended	Possible	Recommended (install in DMZ)	Last Resort!
Forefront for Office Communications server	Possible	Possible	Not supported	Last Resort!
Closed environment (no internet/network access)	N/A	N/A	N/A	Recommended

Let’s now discuss these methods and explain when each is most appropriate to use:

·         A: Direct HTTP Updates from Microsoft Servers

·         B: UNC Hub Updates

·         Combining Direct HTTP Updates and UNC Updates for Redundancy

·         C: Pushing out Updates via FSSMC

·         D: Manual Download of Engine Files with UNC Updates

·         General Notes

·         Abbreviations

A: Direct HTTP Updates from Microsoft Servers

This is the default, enabled update method for our products. A process called GetEngineFiles.exe takes the default HTTP path (from SETTINGSàScanner Updates in the Administrator UI) and adds a bit more to it, in order to download engine files directly from Microsoft update servers.

If you are only using a few Antigen / Forefront servers and do not have a license for FSSMC, then this may be the best option for you.

B: UNC Hub Updates

For this method, at least one server (our update ‘hub’ – not to be confused with an Exchange 2007 Hub Role J) still needs to download engines from a Microsoft HTTP update server. This can be any Antigen 9 or Forefront (FSE/FSSP/FSOCS) product that has internet access. You then share the ‘Engines’ folder within that installation, so that other Antigen / Forefront servers can use a UNC path to update from the hub (rather than from Microsoft HTTP servers):

This helps to reduce internet bandwidth usage and also to speed up downloads on the local LAN.

Depending on your internal network speed and number of servers dependent on the hub, you might want to setup more than one hub, e.g. one per site.

In order to avoid possible contention for engine folder writes, you must also enable the ‘Redistribution Server’ setting on any hub servers. This is found under SETTINGSàGeneral Options in the Administrator UI.

Combining Direct HTTP Updates and UNC Updates for Redundancy

Antigen 9 or Forefront (FSE/FSSP/FSOCS) products permit up to 2 update locations per scan engine. Use these to your advantage to provide redundancy in your environment. Depending on your specific needs, you might choose any one of these combinations for your Network Update Paths (NUP):

·         Set the Primary NUP to the HTTP default location, but point the Secondary NUP to a share on another server to retrieve updates from another servers (UNC path), should the HTTP path become unavailable;

·         Set the Primary NUP to update from your UpdateHub1 (via UNC) to take advantage of your speedy LAN. Set the Secondary NUP to the HTTP default location, should UpdateHub1 not be available;

·         Set the Primary NUP to update from your UpdateHub1 (via UNC) to take advantage of your speedy LAN. Set the Secondary NUP to your UpdateHub2 for redundancy.

Note: a Secondary NUP is only used when the Primary NUP is unavailable. If the Primary NUP is available but does not have any new updates, the Secondary NUP is not checked.

C: Pushing out Updates via FSSMC

You can use FSSMC to do the following, with regard to engine updates:

·         Download and cache the latest 5 Update Versions for any engine;

·         Deploy new engines automatically to any Forefront servers that you specify;

·         Poll Forefront servers to see if they have the latest Update Version or not (automatic comparison).

FSSMC is the recommended way to update multiple Antigen 9 and Forefront (FSE/FSSP/FSOCS) servers in a large organisation. It is used in place of HTTP/UNC updates (methods A and B above), as it proactively pushes new updates out to all managed Antigen 9 or Forefront (FSE/FSSP/FSOCS) products. Make sure that you have disabled all local updates on each Antigen and Forefront server before using FSSMC to deploy updates to them.

FSSMC is available through normal MS channels. For more information, please use these links:

·         FSSMC Home

·         FSSMC Forum

Note that FSSMC does not support FSOCS at this time.

D: Manual Download of Engine Files with UNC Updates

You’ll see that this is almost always down as the “Last Resort” in the table above, because it really does take a lot of hassle to set up. Ideally, you’d use a script to frequently check for and download new engines (2 files per engine; manifest.cab and <Engine>_fullpkg.cab).

This method also has the disadvantage of you needing to download the full engine package each time, whereas all of the aforementioned methods do not (they will frequently use incremental update packages). Full updates can comprise of 15-60MB of data, so this method is not only a pain to setup, but is also bandwidth-intensive. Still, it may be your only option in an environment where you have no direct access to the internet or other Antigen 9 or Forefront (FSE/FSSP/FSOCS) product installs.

The idea is to download and present the engine files to a folder structure similar to that of the Engines folder in any Antigen 9 or Forefront (FSE/FSSP/FSOCS) product. Whether you choose to download files manually or write a script to do this, the steps you’ll need to follow to download and house engine files will be the same:

1.       On the download server (machine that does have internet access), create the download folder structure, sharing the top-level folder (if necessary). Use this structure format:

You will have one EngineName folder per engine (!) and the UpdateVersion folder name will depend on the currently available engine (see step 3 to retrieve the Update Version per engine).

2.       Download the manifest.cab for each engine. This needs to be saved into both the EngineName and the UpdateVersion folders. Here are the links to the various manifest.cab files:

3.       Open the manifest.cab and parse the manifest.xml file within, looking for the value of the “version” element:

4.       You can now complete the download folder structure by creating the UpdateVersion subfolder for each engine, as you now know the update version number from each manifest.xml.

5.       Download the engine package CAB by amending and retrieving the following URL:

 FOREFRONT: https://forefrontdl.microsoft.com/server/scanengineupdate/x86/<Engine>/

Package/<UpdateVersion>/<Engine>_fullpkg.cab

 ANTIGEN: https://antigendl.microsoft.com/antigen/x86/<Engine>/Package/<UpdateVersion>/

<Engine>_fullpkg.cab

...where <Engine> is the name of the engine that you are retrieving and <UpdateVersion> is the “version” element’s value from manifest.xml, e.g.

FOREFRONT: https://forefrontdl.microsoft.com/server/scanengineupdate/x86/Microsoft/

Package/0904080003/Microsoft_fullpkg.cab

ANTIGEN: https://antigendl.microsoft.com/antigen/x86/Microsoft/Package/0904080003/

Microsoft_fullpkg.cab

Each CAB file should be saved to the corresponding UpdateVersion subfolder.

6.       Next, copy the entire engine source folders to the isolated environment (assuming there is no direct access to the machine that you used for downloads). You may even need to copy the files across on a USB stick to do this, maintaining the same folder structure.

7.       Wherever your final engine source folders are located, next share the top level folder. You should end up with a folder structure like this:

Note that the same manifest.cab appears in 2 places and <Engine>_fullpkg.cab only needs to be in the UpdateVersion subfolder. Check that this is the same for every engine that you need to update.

8.       In the Antigen 9 or Forefront (FSE/FSSP/FSOCS) Administrator UI, go to SETTINGSàScanner Updates and set the Primary Network Update Path for each engine to your UNC share, i.e. \\server1\MyShareName$

9.       For each engine, now either click on the Update Now button to trigger an immediate download of the engine from the engine source folders, or alternatively schedule updates per engine.

General Notes

·         Important: the Manual Download method (D) requires manual intervention on your part; therefore it would only be supported by CSS on a best-effort basis, should you run into any issues. CSS does not provide any scripts to support this method at present.

·         Manifest.cab files expire within a certain time limit for added security (varies per engine; usually within a few days).

·         At the current time of writing, Antigen 9 or Forefront (FSE/FSSP/FSOCS) update files are interchangeable, so you can use Forefront engines for Antigen 9 and vice-versa. This means that you can use one hub to serve both Antigen and Forefront installations via UNC (or only need to download one set of files if you are updating manually).

·         Even if you are running a Forefront (FSE/FSSP/FSOCS) product on a x64 platform, the paths to engines will contain “x86”, since all engines are 32-bit.

·         The name of the Kaspersky engine for manual updates should be ‘Kaspersky5’ (not ‘Kaspersky’).

·         The name of the Virus Buster engine for manual updates should be ‘VBuster’ (not ‘Virus Buster’ or ‘VirusBuster’).

Abbreviations

CSS - (Microsoft) Customer Service and Support

FSE - Forefront Server Security for Exchange

FSOCS - Forefront Security for Office Communications Server 2007

FSSMC - Forefront Server Security Management Console

FSSP - Forefront Server Security for Sharepoint

NUP - Network Update Path

UNC - Universal Naming Convention. Example path: \\server1\MyShareName$

Cheers,

Andy Day

Microsoft CSS (Customer Service and Support)