FortiGate Administration Guide - FirewallShop.com

Antispam
Using Perl regular expressions
Some spammers use unsecured third party SMTP servers to send unsolicited
bulk email. Using DNSBLs and ORDBLs is an effective way to tag or reject spam
as it enters the network. These lists act as domain name servers that match the
domain of incoming email to a list of IP addresses known to send spam or allow
spam to pass through.
There are several free and subscription servers available that provide reliable
access to continually updated DNSBLs and ORDBLs. Please check with the
service being used to confirm the correct domain name for connecting to the
server.
Note: Because the FortiGate unit uses the server domain name to connect to the DNSBL
or ORDBL server, it must be able to look up this name on the DNS server. For information
on configuring DNS, see “Network Options” on page 99.
Using Perl regular expressions
Email address list, MIME headers list, and banned word list entries can include
wildcards or Perl regular expressions.
See http://perldoc.perl.org/perlretut.html for detailed information about using Perl
regular expressions.
Regular expression vs. wildcard match pattern
Word boundary
A wildcard character is a special character that represents one or more other
characters. The most commonly used wildcard characters are the asterisk (*),
which typically represents zero or more characters in a string of characters, and
the question mark (?), which typically represents any one character.
In Perl regular expressions, the ‘.’ character refers to any single character. It is
similar to the ‘?’ character in wildcard match pattern. As a result:
• fortinet.com not only matches fortinet.com but also fortinetacom, fortinetbcom,
fortinetccom, and so on.
To match a special character such as '.' and ‘*’ use the escape character ‘\’. For
example:
• To match fortinet.com, the regular expression should be: fortinet\.com
In Perl regular expressions, ‘*’ means match 0 or more times of the character
before it, not 0 or more times of any character. For example:
• forti*.com matches fortiiii.com but does not match fortinet.com
To match any character 0 or more times, use ‘.*’ where ‘.’ means any character
and the ‘*’ means 0 or more times. For example, the wildcard match pattern
forti*.com should therefore be fort.*\.com.
In Perl regular expressions, the pattern does not have an implicit word boundary.
For example, the regular expression “test” not only matches the word “test” but
also any word that contains “test” such as “atest”, “mytest”, “testimony”, “atestb”.
The notation “\b” specifies the word boundary. To match exactly the word “test”,
the expression should be \btest\b.
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 455