Using SpamRats IP Reputation with Cisco Devices

SpamRats for Cisco Appliances

While Cisco is not yet a technology partner, we have many Cisco users that wish to use SpamRats RBL's with their appliances. However, there ARE problems reported, depending on the DNS Resolvers configured in the device. While Cisco supports the use of 3rd party RBL's, it is important that you ONLY configure SpamRats using an API key. You should also confirm that it works, and no firewall rules or policies prevent you from reaching the SpamRats RBL mirrors.

For more information, please consult your Cisco XDR documentation, or contact your Cisco Support representative

SpamRats for TrendMicro

While Trend Micro is not yet a technology partner, we have many Trend Micro users that wish to use SpamRats RBL's with their appliances. However, currently it is reported that TrendMicro does not support the use of 3rd party RBL's other than the ones it currently uses. The choice of default RBL's can be controversial. Other products such as SonicWall Email Security or WebSense DO allow this. However, it is important that you ONLY configure SpamRats using an API key when using a commercial filtering appliance of any type. You should also confirm that it works, and no firewall rules or policies prevent you from reaching the SpamRats RBL mirrors.

SpamRats for IronPort

While IronPort is not yet a technology partner, we have many IronPort users already trying to use SpamRats RBL's with their appliances. Setting up SpamRats on IronPort is simple and easy, but there are a few things to watch out for. It is important that you ONLY configure SpamRats using an API key. You should also confirm that it works, and no firewall rules or policies prevent you from reaching the SpamRats RBL mirrors.

SpamRats on IronPort can be configured both from the GUI as well as the command line (CLI>

Configuring SpamRats on IronPort via GUI

For adding SpamRats RBL's to the IronPort GUI, we recommend that you follow IronPorts' own documentation, but in brief..

   Log into the ESA (Web GUI) eg.. https://:8443
   GoTo Mail Policies → HAT Overview
   Choose the 'listener' where you want the RBL's to be applied, eg InboundMail
   Edit the Mail Flow Policy for the “UNKNOWNLIST” sender group
   In policy editor, look for: DNS Listeners (DNS-based Blackhole Lists / RBLs)
   Click "Add" and enter your RBL information, eg DNS Server name ..
       [YOUR_API_KEY].dyna.spamrats.com
   Set the action for hits: (Drop/Quarantine)
   Commit Changes
   

Configuring SpamRats on IronPort via CLI

   ssh admin@esa-hostname
   > listenerconfig
   > edit 
   > hostaccess
   > policyconfig
   > rblconfig
   > new
     Name: SpamRats RATS-DYNA
     Query string: [YOUR_API_KEY].dyna.spamrats.com
     Timeout: 5
     Enabled: Y
   > commit
   

Using SpamRats RATS-AUTH to prevent Email Compromise

Very Important! Using this on your authentication listeners is powerful... for all authentication surfaces, including POP/IMAP/SMTP(25,465,587) and WebMail. You can even use it to protect other logins on your server. SpamRats has multiple other RBL lists available that can further help secure your attack surfaces.