cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1425
Views
0
Helpful
6
Replies

Bloking/Drop Domain Using by Reputation

rhidayat.sr
Level 1
Level 1

Please your solution, iam newly for ironport.
we have Ironport C170 with version 10.0
How make  block/drop domain with using reputation, so it automatically will be drop.
And this is avoid ip spam blocking.
current configuration, we use manualy bloking domain.

 

Thanks,

6 Replies 6

Libin Varghese
Cisco Employee
Cisco Employee

The ESA uses senderbase lookups to determine reputation of the sending IP and matches it to a sendergroup.

 

Sender IP's with poor email reputation are blocked by default, this can be viewed under Mail Policies -> HAT Overview.

 

Regards,

Libin Varghese

in the hat overview, we've already made some policy. including Blacklist
and the Blacklist sender list, and we input manualy the spam domain if we receive spam email from cust.
How if withaut input the domain, and just set the policy Blacklit and Reputation.
is it posible.

we have a new case, in now version, sometime URL Filtering is timeout,
and we ping to v2.sds.cisco.com replay, with time=191.299 ms.

Please your solution

HAT sendergroup only accepts sender IP/hostname, domain would not work here.

 

As for URL filtering timeout, it suggests a network interruption at certain times.

 

What is the exact error that you see?

What Async OS version are you?

can you provide step and solution, how to drop/block email spam automaticly before receive to client.
this sample like spam @getriverteam.com,@chello.fr,@vuzt.cz,@cenco.us
current conditions, we must manually input spam emails to Mail policies - Incoming Mail Policies - Policies Block - users (edit)

URL Filtering, Conenction Status : connection could not be established due to module named thread.
What Async OS version : 10.0.0-203

Thanks,

Blocking domains would be using the incoming mail policies, message/content filters as you are currently performing.

 

As for the URL filtering error, it may indicate a transient network issue. However, if you continue to see the same error multiple times I would recommend opening a TAC case to get the appliance reviewed.

thanks for the support, i will follow to tac regional.