Advanced Malware Protection-File Analysis Service Not available on ESA

[jjtech]

Hi,

We have an ESA Ironport C195 running AsyncOS 12.5.3 (We're scheduling its upgrade in the coming weeks to a recommended release) set up with Exchange server. In the last few days, our users started getting Warning : Unscanned Attachment prepended to their incoming emails subject.

After checking Message Tracking, I found that the AMP and File Analysis Services are not available :

Response received for file reputation query from Cache. File Name = ....pdf, MID = ..., Disposition = UNSCANNABLE, Malware = None, Analysis Score = 0, sha256 = ... , upload_action = Recommended to send the file for analysis
File not uploaded for analysis. MID = ... File SHA256[...] file mime[application/pdf] Reason: The File Analysis service is not available
The attachment could not be scanned. File Name = ...pdf, MID = ..., Unscannable Category = Service Not Available, Unscannable Reason = The File Analysis service is not available
Message ... is unscannable by Advanced Malware Protection engine. Reason: Service Not Available
Message ... scanned by Advanced Malware Protection engine. Final verdict: UNSCANNABLE

I confirmed the Smart Licensing, it's registered and authorized and licenses are in compliance. I also tried to restart the AMP service from ESA cli, but still the same behavior.

Any idea what could be the reason for this behavior ?

[Nasreen Al Haddad]

Hello,

Version 12.5 has reached its end-of-life and is no longer supported. It is advisable to upgrade the Email Security Appliance to a version that is currently supported, which could potentially resolve the issue. For more information, please refer to the following link: https://www.cisco.com/c/en/us/products/collateral/security/email-security-appliance/eos-eol-notice-c51-743742.html

Br,