Printable Version of Topic
Click here to view this topic in its original format
914World.com _ 914World Garage _ OT: Anyone use Barracuda Networks Spam Firewall?
Posted by: BigDBass Jun 13 2006, 10:06 AM
Just wondering if any of the IT types here are using a Barracuda email firewall. We are, and normally love it, but this morning it stopped processing incoming mail and, frighteningly, the Barracudanetworks.com website is down and there is no answer on the phone... Anyone have a similar or different situation with their Barracuda today?
Posted by: skline Jun 13 2006, 10:13 AM
It was all a scam to get many users and then shut the doors and sell the info to hackers. Watch your back buddy, anything can happen at this point. 
Posted by: KaptKaos Jun 13 2006, 10:27 AM
That can't be good. I wonder how this is impacting other users.
I know a few large companies that use Barracuda. I think I will call them now =)
Posted by: BigDBass Jun 13 2006, 10:29 AM
Skline, I hope you're kidding?
Joe, if you check on any Barracuda users, let me know what you find out, please.
Posted by: BigDBass Jun 13 2006, 10:33 AM
Just got a call back from my Barracuda reseller. Says Barracuda is working on the stalled inbound queue, they're in the middle of a server cutover (?), and they know the phones are down. Strange...
Posted by: Brad Roberts Jun 13 2006, 10:52 AM
Let me know if I can help.
We stopped selling Barracuda because of support issues.
We really like the Tumbleweed product.
Secure computing has some nice solutions also.
B
Posted by: BigDBass Jun 13 2006, 11:03 AM
My reseller found out :
Brad, thanks for the leads on alternative products. I can relate to the support issues. We need to move to a bigger box in the not too distant future and I've been debating if I want to move to a new product entirely.
Posted by: KaptKaos Jun 13 2006, 11:11 AM
Never been a fan of tumbleweed, tho they tried to recruit me heavily. I did not like the architecture that put SQL on the gateway. Not sure if it is different now.
Marshal software makes a really nice product (MailMarshal) that can handle tons of users, multiple servers and multiple av engines. Tumbleweed always knocked them as a "point prodcut" meaning that it was not centrally managed. But, its now got those features.
I'd be really curious to hear how tumbleweed is doing. Since my old 3Com bud, Burton left them a few years ago I haven't heard much from them.
Posted by: Steve Thacker Jun 13 2006, 11:36 AM
I use Clearswifts MailSweeper for SMTP. I also run the Domino version on my internal mail systems. Best products on the planet.
Posted by: Brad Roberts Jun 13 2006, 11:50 AM
How many users?
B
Posted by: Steve Thacker Jun 13 2006, 11:58 AM
Brad if the question was for me I have over 15k seats. Just over 390k mail messages daily. I'm at over 97.8 spam efficiency. Very little spam makes it inside. What might sneak through normally gets caught on the Domino mail hub.
Posted by: BigDBass Jun 13 2006, 12:06 PM
Moments after the fix was identified, the support website magically came back up...
I can't say I'm all that happy with the efficiency of our Barracuda, and support is not so hot either.
We have about 4500 users, most of which are our (university) students.
Our current box will only work with a single server as it was purchased when we had only a single email system. We have since added another and dedicated one to students and the other to staff and faculty. I had been more or less intending to upgrade to a more robust model that will handle multiple servers, but as time passes, I'm becoming more inclined to find a new solution.
Posted by: Brad Roberts Jun 13 2006, 12:20 PM
Steve,
that is a LOT of users! I would like to take a look at the solution you are using. Sounds like something that works well for you.
I *thought* that I had seen them all 
B
Posted by: Steve Thacker Jun 13 2006, 01:07 PM
Yea it is a lot of folks. A hair less than I had when I was the sr. mail and database admin for Bank One...now Chase.
Here is a link to the clearswift people. >>> http://www.clearswift.com
They really have their stuff together. I have tried so many spam packages that I finally have one that "really works". When I was consulting I setup many companies on this product. It also allows for super customization. So, as your organization grows it grows also. They also have the best support.
I also do lookups to the sites below inside the mailsweeper.
These sites kick the spammers to the curb.
sbl-xbl.spamhaus.org
bl.spamcop.net
relays.ordb.org
dnsbl.sorbs.net
The company makes one for microsoft mail systems and another for us domino people. I use both to put the double whammy on the spammers.
Apologies for the Hijack!
Posted by: Part Pricer Jun 14 2006, 07:30 AM
It looks like their website was down because of a free t-shirt giveaway.
http://www.darkreading.com/document.asp?doc_id=97120&WT.svl=news1_1
Posted by: BigDBass Jun 14 2006, 07:39 AM
Even better: When I called and gave them a piece of my mind yesterday after it was fixed, they insisted on sending us a few T-shirts for our trouble. I didn't want T-shirts. I want their shit to be reliable so I don't get bitched at.
Posted by: KaptKaos Jun 14 2006, 08:41 AM
Before I was a MArshal partner, I was a Content Technologoies partner (then Baltimore, now Clearswift). I haven't looked at the MIMEsweeper products in years. When I last looked at them, they had issues with throughput. We have a major entertainment company with over 16k users running through basically 2 mailmarshals at the gateway. They not only get over 500k mail per day, but it is very very attachment heavy. Nothing else that they tried could handle their mail volume.
As for Real Time Black Lists (RBLs), while they do work, they are also very very problematic. Many times, they have false positive problems where domains get on their lists because the RBLs do not properly check for open relays. And once you are on their lists, it is nearly impossible to get off of them. These are basically unmanned list servers with no accountability. If your domain gets onto an RBL, you can expect several days worth of work to get off of their list.
IMO the real test of a gateway solution, aside from volume, is the false positive rate and end user management. If you have a low false positive rate and the ability for end-users to release their own junk mail and manage their own white and black lists, then you are doing pretty good.
Additionally, we used to put product on the internal systems too, but after a few years of it, we found that those were really only used for HR purposes as the gateway really did most of the work.
Just my 2 cents after being in the content security space for about 8 years.
BTW: Is David Guyatt still with Clearswift?
Posted by: BigDBass Jun 14 2006, 09:12 AM
Yeah, it's those damn false positives. We have that under control, but at the cost of a large number of spam messages getting through with a [SPAM] tag in the subject.
Lately, our biggest spam problem is with blocked messages bouncing back to forged from addresses. If I turn off that notification, I lose my only tool to identify false positives.
Posted by: Steve Thacker Jun 14 2006, 10:43 AM
Before I was a MArshal partner, I was a Content Technologoies partner (then Baltimore, now Clearswift). I haven't looked at the MIMEsweeper products in years. When I last looked at them, they had issues with throughput. We have a major entertainment company with over 16k users running through basically 2 mailmarshals at the gateway. They not only get over 500k mail per day, but it is very very attachment heavy. Nothing else that they tried could handle their mail volume.
As for Real Time Black Lists (RBLs), while they do work, they are also very very problematic. Many times, they have false positive problems where domains get on their lists because the RBLs do not properly check for open relays. And once you are on their lists, it is nearly impossible to get off of them. These are basically unmanned list servers with no accountability. If your domain gets onto an RBL, you can expect several days worth of work to get off of their list.
IMO the real test of a gateway solution, aside from volume, is the false positive rate and end user management. If you have a low false positive rate and the ability for end-users to release their own junk mail and manage their own white and black lists, then you are doing pretty good.
Additionally, we used to put product on the internal systems too, but after a few years of it, we found that those were really only used for HR purposes as the gateway really did most of the work.
Just my 2 cents after being in the content security space for about 8 years.
BTW: Is David Guyatt still with Clearswift?
Not sure on David Guyatt
I have very very few false positives with the 5.2 Mailsweeper. It is all a distributed design now and throughput is not an issue any longer. The RBL is no longer an issue either. The Receiver service is now a separate component and it has a section to whitelist/Safelist a known good sender, even if they are on a RBL. It also has PMM "Personal Message Manager" . Basically the users control their own mail. I just scan for bad images, profanity, etc.
Powered by Invision Power Board (http://www.invisionboard.com)
© Invision Power Services (http://www.invisionpower.com)