Sophos XG: How to add a POP/IMAP policy in legacy mode

Overview

SMTP Malware Scan policies appear only when Legacy mode is enabled. The device acts as a transparent proxy

It helps protect the enterprise mail server system

How to configure

• Email -> General setting -> Check and switch to Legacy mode

• Email -> Policies -> Choose POP/IMAP scan

• Enter Name for the policy
• Enter Email address/domain group
  • Sender
    • Contains: Specify the keywords to be matched with the senders’ email addresses
    • Equals: Specify the senders’ exact email addresses
  • Recipient
    • Contains: Specify the keywords to be matched with the recipient email addresses
    • Equals: Specify the recipients’ exact email addresses
  • Filter criteria
    • Inbound Email is
      • Spam
      • Probable Spam
      • Virus Outbreak
      • Probable Virus Outbreak
    • Source IP/Network Address: Sender’s IP address matches the specified IP address
    • Message Size: Sender’s email size matches the specified restriction of message size
    • Message Header: Select from the following message headers to match the specified keyword:
      • Subject
      • From
      • To
      • Other
      • Contains: Specify the keywords to be matched with the message header
      • Equals: Specify the exact match to the actual headers
  • Action
    • Accept: Email is accepted and delivered to the intended recipient
    • Prefix Subject: Email is accepted and delivered to the intended recipient after adding a prefix to the subject line. Specify the prefix in the To field. You can set the prefix to indicate the filter criteria

-> Click Save

• Firewall -> Add firewall rule -> Choose Business application rule

• In Application template: Choose Email Clients (POP & IMAP)
• In Source zone: Choose Any
• In Networks: Choose Any
• In Destination zone: Choose Any
• In Networks: Choose Any

-> Click Save