All Mail incomming With tag [WARNING : A/V UNSCANNABLE] ?

[NABILIT]

Hi Team

We have some isue with our Appliance, We receive all incoming mail with tag  WARNING : A/V UNSCANNABLE, Also when we try to see the tags with client Outlook we found ==> X-IronPort-AV: E=Sophos;i="unknown";
   e="0x0't"; a="129425", So unknown it means no scan mail ?

FYI, the mail test are no crypted, no zip ,no picture , its a simple mail to test

Could you support us please ?

regards

[dmccabej]

Hello,

If every email is coming through as unscannable then there may be an issue related to the Sophos engine. Are you still seeing the issue?

You could try the following from the CLI :

avstatus sophos detail

updatenow force

Thanks!

-Dennis M.

[NABILIT]

Hi Dennis

Thanks for your feedback, If we see on the consol , We found that Anti-Virus Scanning by Sophos Anti-Virus: is
Enabled and the congi is Virus Scanning Timeout (seconds):60 

the comand avstatus sophos detail return Failed to fetch sophos version information: ['Traceback (most recent call

the command ==> avstatus

and after run  SOPHOS ==>

SAV Engine Version        xxxxxxxxxxxxxxxxx
    IDE Serial                xxxxxxxxxxxxx
    Last Engine Update        13 Nov 2018 16:13 (GMT +00:00)
    Last IDE Update           19 Nov 2018 15:13 (GMT +00:00)

the Comand ==> updatenow force return

Success - Force update for all components requested

Regards

[dmccabej]

Hello,

The last IDE update shows November, which would make me think that for some reason this ESA is not receiving updates. Do you know which AsyncOS version is being used? You can get this using the version command from the CLI. Is the last update still showing November?

Thanks!

-Dennis M.

[NABILIT]

Hi DENNIS

After more invistigation , Our version is end of life, no new updates are availabel, We should update our software to get a new updates :(

https://www.cisco.com/c/en/us/products/collateral/security/email-security-appliance/eos-eol-notice-c51-738364.html

Thanks again for your help

[dmccabej]

Hello,

Yes, that would be correct. 9.x updates (excluding 9.8.1) have been ceased due to EoL/EoS software. You should be able to upgrade beyond 10.x, start receiving updates again, and hopefully, that corrects the Sophos engine.

Thanks!

-Dennis M.