About the Fastpass performance enhancement feature in Symantec Mail Security 6.5 for Microsoft Exchange

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

Symantec Mail Security 6.5 for Microsoft Exchange (SMSMSE) introduces a new performance enhancement feature called Fastpass. This document describes what Fastpass does and how to disable it if you do not want to use this feature.

Resolution

About Fastpass
Fastpass improves Premium AntiSpam performance by skipping a subset of antispam filters for logical connection addresses with a demonstrated history of sending no spam messages. A "pass" is granted to a message source if that source has sent a specified number of consecutive, sampled legitimate messages (25 by default). Once a source has received a pass, the amount of antispam processing that is applied to messages from that source decreases. The number of messages that are permitted to bypass antispam filtering increases as more and more
legitimate email comes from the source. Fastpass reduces the processing time that is required for messages from legitimate sources.

If a message source that has a pass subsequently sends a spam message that is sampled, the pass is immediately revoked. A full antispam analysis is performed on all messages from that source. The source remains eligible to receive another pass, however, by once again meeting all the criteria that is specified in the module configuration.

How Fastpass works
The libfastpass module uses a memory-resident table to store and categorize the message source. IP addresses are granted a pass and those that are currently being evaluated for a possible pass. Fastpass takes some time to build up its effectiveness after it is first enabled. However, Fastpass retains its data across restarts, and the data it collects is persistent across restarts.

The Fastpass table is divided into two parts:

• Trial Table
  
  By default, the Fastpass table can contain up to 250,000 IP address entries. 25% of the overall table size is reserved for the IP addresses that are granted a pass (up to 25,000 entries). The remaining 75% is reserved for trial table space. The trial table contains the entries that are being evaluated for inclusion in the pass table. A determination is made to move an IP address from the trial table to the pass table according to successful testing for legitimate messages for the IP address.
  
• Pass Table
  Contains the entries that are granted a pass by the Fastpass module based on no spam coming from the IP address for a specified number of messages.

To disable Fastpass

1. Open the SMSMSE console.
2. Navigate to Policies -> Premium AntiSpam settings
3. Uncheck "Fast Pass" and click Deploy Changes

Note: Disabling Fastpass may improve spam detection but will decrease performance.




References
Detailed information on the fastpass module can be found in the Symantec Brightmail Message Filtering implementation guide: ftp://ftp.symantec.com/public/english_us_canada/products/symantec_brightmail_message_filter/6.1/manuals/sbmf_imp_guide_610.pdf

Page 95 – 97, 132 – 138, 186 – 188, 298, 300