02-03-2011 06:30 AM
I have quesitons on filtering attachments.
1. Where do I set the filter in the gui?
2. Is there a text file (or some other way) that I can edit to configure what file is considered to be an "Executable"
3. Can I create a file type, for example "script" and add various file types to block.?
Solved! Go to Solution.
02-03-2011 07:09 AM
Hello there,
filters are accessible on the GUI via the
GUI: Mail Policies - > Incoming Content Filters
or
GUI: Mail Policies - > Outgoing Content Filters
Note the difference, inbound is usually any mail coming from the internet via a normal ACCEPT mail flow policy, while outbound mail is considered to be via either private listeners and/or a RELAY policy. In the filter setup you can create filter conditions and actions based on either file names, mime type, or file type. The file type list has a number of predefined file types and groups (executable, image, document, etc) that you can select from, note that this is a fixed list and that you cannot add filetypes to it manually. Same for the grouping of filetypes.
Also, after creating a filter don't forget to add it to one or more of you mail policies
GUI: Mail Policies - > Incoming Mail Policies -> Content Filters
GUI: Mail Policies - > Outgoing Mail Policies -> Content Filters
Otherwise the filter won't be used.
Hope that helps,
Andreas
02-03-2011 07:09 AM
Hello there,
filters are accessible on the GUI via the
GUI: Mail Policies - > Incoming Content Filters
or
GUI: Mail Policies - > Outgoing Content Filters
Note the difference, inbound is usually any mail coming from the internet via a normal ACCEPT mail flow policy, while outbound mail is considered to be via either private listeners and/or a RELAY policy. In the filter setup you can create filter conditions and actions based on either file names, mime type, or file type. The file type list has a number of predefined file types and groups (executable, image, document, etc) that you can select from, note that this is a fixed list and that you cannot add filetypes to it manually. Same for the grouping of filetypes.
Also, after creating a filter don't forget to add it to one or more of you mail policies
GUI: Mail Policies - > Incoming Mail Policies -> Content Filters
GUI: Mail Policies - > Outgoing Mail Policies -> Content Filters
Otherwise the filter won't be used.
Hope that helps,
Andreas
02-03-2011 08:10 AM
Thanks!
So, maybe a feature request would be to be able to edit groups, add a new group. Currently I want to block script files, pretty common thing. I know I can add these individually but there are at least 15 or 20 script type suffixes.
02-03-2011 11:41 PM
Greetings,
I believe the script files are normally executables or may be embedded within a ZIP file and both can be blocked using current executables or compressed files option under file type. Also IronPort has option to block matching a specific filename or pattern based on its fingerprint. You need to check the best suitable option based on file type, file name, extensions etc.
Cheers,
Viquar Ahmed
Customer Support Engineer Cisco IronPort
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide