Adding a disclaimer

[Doug Maxfield]

Good Morning,

We are getting ready to move our C370 into production and one of the last items that we need to look at is the Disclaimer.

We have figured out how to add our Disclaimer to every e-mail going out, but here's what we would like to do.  Currently with PMDF, our current mail gateway, we have the ability to check to see if a disclaimer has already been added to an outbound e-mail.  If it exists, we do not add it again.  I don't see where I can do that with the C370.

Is this something that can be done and if so, how?

Thanks in advance,

Doug

[Christopher Smith]

HI Doug,

There is a way to do this on the IronPort appliance. Its not to difficult, I have outlined the steps below.

• Log into command line of device
• Issue the filters command
• Select New from the menu
• Paste the filter below (please ensure you replace the SNIPPET portion with a short sentence from your disclaimer)
  
  no_duplicate_disclaimer:
  if (sendergroup == "RELAYLIST")
  {
  if not (body-contains("SNIPPET FROM DISCLAIMER", 1))
  {
  add-footer("disclaimer_1");
  }
  }
  .
• Press the enter key several times
• Issue the commit command

Let me know if you have any additional questions.

Christopher C Smith

CSE
Cisco IronPort Customer Support 

[Doug Maxfield]

Chris,

Thanks for the help.  I put in the filter as you instructed but it's still adding the disclaimer when it shouldn't.  I have attached a screen shot of the trace test that I ran and also the modified filter rule for our environment.

Thanks,

Doug

[viahmed]

Hi Doug,

The attached trace image is hardly visible.

Please remember you have to use an IP from your 'RelayList' in your trace utility in order to see the exact processing of this filter. Please reply back with copy paste snippet of your trace result. Also double check the IP address you are using in the trace tool exists in the relaylist.

Regards,

Viquar

Customer Support Engineer

[Doug Maxfield]

Viquar,

I used an IP from our Relaylist.  I have saved the file in a .pdf so that you can "blow it up".

Doug

Screen shot:

Logged in as: admin on greeneye.emcins.com   Options Account Change Password Log Out Help and Support Help Online Help Support Portal New in this Release Technical Support Open a Support Case Remote Access Packet Capture

• Monitor
  • Reports
  • Overview
  • Incoming Mail
  • Outgoing Destinations
  • Outgoing Senders
  • Delivery Status
  • Internal Users
  • DLP Incidents
  • Content Filters
  • Virus Outbreaks
  • Virus Types
  • TLS Connections
  • System Capacity
  • System Status
  • Scheduled Reports
  • Archived Reports

  • Quarantines
  • Message Tracking
• Mail Policies
  • Email Security Manager
  • Incoming Mail Policies
  • Incoming Content Filters
  • Outgoing Mail Policies
  • Outgoing Content Filters

  • Host Access Table (HAT)
  • HAT Overview
  • Mail Flow Policies
  • Exception Table

  • Recipient Access Table (RAT)
  • Destination Controls
  • Bounce Verification

  • Data Loss Prevention (DLP)
  • DLP Policy Manager

  • Domain Keys
  • Domain Profiles
  • Signing Keys

  • Text Resources
  • Dictionaries
• Security Services
  • Anti-Spam
  • IronPort Anti-Spam

  • Anti-Virus
  • Sophos
  • McAfee

  • Data Loss Prevention
  • RSA Email DLP

  • IronPort Email Encryption
  • IronPort Image Analysis
  • Virus Outbreak Filters
  • SenderBase

  • Monitoring Services
  • Reporting
  • Message Tracking
  • External Spam Quarantine

  • Service Updates
• Network
• System Administration
  • Trace
  • Alerts
  • LDAP
  • Log Subscriptions
  • Return Addresses

  • Network Access
  • Users
  • Network Access

  • System Time
  • Time Zone
  • Time Settings

  • Configuration File

  • Feature Keys
  • Feature Key Settings
  • Feature Keys

  • Shutdown/Suspend

  • Upgrades
  • System Upgrade

  • System Setup
  • System Setup Wizard
  • Next Steps

	Trace — Trace Results Host Access Table Processing           (Listener: OutboundMail) Fully Qualified Domain Name: Unknown Host Matched On: 172.22.0.3 Sender Group: RELAYLIST Named Policy: RELAYED Connection Behavior: RELAY SenderBase Network Owner ID: N/A SenderBase Reputation Score: N/A Policy Parameters: Max. Messages Per Connection: 10,000 Max. Recipients Per Message: 100,000 Max. Message Size: 20M Max. Concurrent Connection From a Single IP:  600 Use TLS: Preferred Accept Untagged bounces: Yes Max. Recipients Per Hour: Unlimited Use SenderBase: No Use Spam Detection: No Use Virus Detection: Yes Envelope Sender Processing Envelope Sender: doug.l.maxfield@emcins.com Default Domain Processing: No Change Envelope Recipient Processing Envelope Recipient: doug@datleemax.com LDAP Accept Lookup: Result:             not performed Default Domain Processing: No Change Domain Map Processing: No Change Alias Expansion: No Change Message Processing Assigned Virtual Gateway: None Assigned Bounce Profile: None Domain Masquerading No changes Filter Processing Encrypt_Messages_with_subject_string Rule: recv-listener == "OutboundMail":                 True Rule: subject == "(?i)^\\$C\\$":                 False Rule: AND:                 False no_duplicate_disclaimer Rule: sendergroup == "RELAYLIST":                 True Evaluating Nested Filter: Rule: body-contains("EMC071856", 1):                 True Rule: NOT:                 False Mail Policy Processing: Outbound (matched on policy DEFAULT) Message going to: doug@datleemax.com End-User Safelist/Blocklist Processing Result: Not Evaluated Anti-Spam Processing Evaluation: Not Evaluated Anti-Virus Processing Evaluation: No Viruses Detected              Elapsed Time: 0.003 sec Actions Taken: Delivered Virus Outbreak Filters Processing Evaluation: Not Evaluated Data Loss Prevention Processing Result: Not Evaluated Disclaimer(s) Added Above Message: No changes Below Message: EMC_Disclaimer DomainKeys Signing Result of DomainKeys processing: DomainKeys signing is not enabled in this listener's HAT DKIM Signing Result of DKIM processing: DomainKeys signing is not enabled in this listener's HAT DKIM Verification Result of DKIM Verification processing: DKIM verification not enabled in this listener's HAT SPF Verification Result of SPF Verification processing: SPF verification not enabled in this listener's HAT Message Delivery (matched on policy DEFAULT) Final Envelope Sender: doug.l.maxfield@emcins.com Final Recipients: doug@datleemax.com Final Message: Message-Id: <0383be$@OutboundMail> Date: 08 Feb 2011 08:21:18 -0600 Received: from unknown ([172.22.0.3])   by mail-ir-int.emcins.com with TEST; 08 Feb 2011 08:21:18 -0600 Subject: Test of Disclaimer if Disclaimer exist Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii" Test to see if disclaimer doesn't get added. Doug EMC071856 NOTICE:  This message (including any attachments) is intended for a specific individual and may contain information that is either confidential or legally protected.  If you believe that it has been sent to you in error, please reply to the sender that you have received the message in error, then delete it. If you are not the intended recipient, you are hereby notified that any retention, dissemination, distribution, or copying of this communication is strictly prohibited.  Thank you.   EMC071856
	Copyright © 2003-2010 Cisco Systems, Inc. All rights reserved.

[viahmed]

Hi Doug,

I will suggest to do a real test instead of relying on trace tool since you dont have the message to confirm it worked or not. Also try following in case you have the disclaimer only in the body of the message.

if (not only-body-contains("EMC071856",1) )

Viiquar

[Doug Maxfield]

Viiquar,

Thanks for the suggestions.  I think that I may have found the problem.  Since I'm using this message filter to check and add the disclaimer if needed, I probably need to turn off the adding of the disclaimer on the Outbound listener?  I had this still on.  Once I removed it, the message processed correctly.

Thanks again!!!

Doug

P.S.  After sending this, I was told that I need to setup this rule so that if specific addresses (Internal address) send mail outside, don't include the disclaimer.  The specific address send SMS messages out to our Tech people and we don't want those messages containing our disclaimer.  Below is the rule as it currently is setup and working without the specific addresses:

no_duplicate_disclaimer:
if (sendergroup == "RELAYLIST")
{
if (not only-body-contains("EMC071856", 1))
{
add-footer("EMC_Disclaimer");
}
}
.

Thanks again!!!!

Doug

[Doug Maxfield]

Viiquar,

With some help, I was able to get this to work:

no_duplicate_disclaimer:
if (sendergroup == "RELAYLIST")
{
    if (not mail-from-dictionary-match('Dictionary-NoDisclaimer'))
    {   
        if (not only-body-contains("EMC071856", 1))
        {
        add-footer("EMC_Disclaimer");
        }
    }
}

Thanks,

Doug