Web application firewall (WAF) and server protection

Stop webmail, SOAP, ActiveSync and admin requests before they reach the mail server; apply a "virtual patch" for zero-day flaws until the fix arrives, block suspicious sources and monitor server file integrity.

Global administratorAdmin console › Tools and Migration › Profelis WAF

Overview

1. Click Tools and Migration › Profelis WAF in the left tree. Three layer badges (Proxy, Filter, Guard) appear green or red at the top.
2. The Overview tab shows the last 24 hours of blocked, rate-limited, suspicious and allowed requests, the most-blocked addresses and the rules that fired.

Profelis WAF: layer badges and Overview

Virtual patch for a new flaw

1. On the Tools tab, enter the path on the Close a path card (for example /service/extension/backup/mboximport) and press Close path; confirm. The rule is saved and applied.
2. On the Live test card of the same tab, enter the path and press Test: you should see 403 and "blocked". Test all tests every closed path.

Tools tab: Close a path and Live test

1. On the Rules tab the path appears on the Closed paths (virtual patch) card; remove it with × on its row.

Rules tab: Closed paths and Admin networks

For known Zimbra flaws the Tools tab has a Virtual patch templates card: tick the templates you want and press Save and apply.

Blocking a suspicious source

1. On the Threats tab, events are clustered and scored by source address; each card shows the rules that fired, the paths requested and the accounts involved.
2. Click the address for details; Events is filtered to it.
3. To block the source, press Block address on the right of the card.

Threats tab: address and Block address

Restricting the admin console to the internal network

On the Rules tab, enter your internal network (for example 192.0.2.0/24) on the Admin networks card (4 in the screenshot above) and press Add. The admin console returns 403 from external addresses.

Do not lock yourself out

Network and address rules apply immediately. Make sure your own address is in an allowed network.

Host protection

1. On the Host protection tab, Verify against baseline shows changed or new files, SSH keys and the administrator list.
2. The Quarantine list shows quarantined files; Restore selected puts a file back.
3. If you are going to install files on the server yourself, press Maintenance on (4h) first and Maintenance off when done.
4. If the change is permanent, record the new state with Take baseline.

The Host protection tab

Scope

IMAP, POP and SMTP traffic is not touched; only HTTP/HTTPS. No content or virus signature inspection. The rate limit is per address; keep it generous for large offices behind a single address (default 60 per minute).