Microsoft Exchange Edge Transport
Microsoft Forefront Security for Exchange.
SMTP Protection Components
The E-Mail Protection solution on Forefront TMG is composed by the following components
- TMGSMTP.gif (9.12 KiB) Viewed 120 times
The first component in the stack is the TMG Filter Driver that runs in Kernel mode. This filter driver will intercept all requests prior to send to the other component that run in User Mode. Exchange Edge Transport components will initially process the message and perform the initial SPAM filtering and then pass the message to the Forefront Security Server for Exchange to perform the Virus scan. The table below describes in more details the component and which product is responsible to handle it:
- TMG2.png (6.99 KiB) Viewed 120 times
Walkthrough an Incoming Message Processing
- TMG3.gif (8.71 KiB) Viewed 120 times
The first step during a SMTP connection is to send a Hello command. When TMG receives this request it sends to Microsoft Exchange Edge Transport to process it. Microsoft Exchange Edge Transport has a series of SMTP transport events that will trigger actions during the message processing. Some of those events will invoke SMTP Agents that are prepared to process a series of parameters, such as verify if the IP that sent the message is an IP allowed or not.
In the case of this first connection the event OnConnect will be used and the Connection Filtering Agent will be processed. This filtering agent will look for parameters that were configured in the Forefront TMG Console, such as the ones showed in Figure
- TMG4.gif (44.35 KiB) Viewed 120 times
Assuming that the connection satisfies all parameters that were specified, the next step for the connection to happen is to analyze the body of the message right after the connection is sent and we have reach the end of the data. At this point the OnEndOfData event is used and two filters are processed: Content filtering Agent and Attachment Filter Agent as shown in Figure
- TMG5.gif (57.51 KiB) Viewed 120 times
If the connection satisfy all parameters that were used then the message will be securely sent to the internal Mail Server.
