Hi Steven,
1.
Emails delivered internally are usually processed by the exchange server directly, however in order to scan internal emails as well we would need to allow email flow through the ESA.
Users -> Exchange -> ESA -> Exchange -> Users
To allow mail flow from the exchange the exchange server would need to inject emails intended for internal domains to the inbound listener of the ESA, while continuing to send other outbound emails to the firewall.
This would need to be tested on your end as there could be unforeseen issues such as for emails with multiple recipients (both internal and external).
2.
ESA can use filters to prevent spoofed emails being generated from the internet, I'm not sure what you mean by spoofed emails from users within same domain. If there are dedicated servers for each domain SPF could be used.
I will attach the forged email detection steps with this post for your reference.
3.
Emails passed through the ESA are subject to rate limiting configured on the mail flow policies.
You could also configure a filter with condition "header-repeats"
Header Repeats Rule
The Header Repeats rule evaluates to true if at a given point in time, a specified number of messages:
* With same subject are detected in the last one hour.
* From same envelope sender are detected in the last one hour.
You can use this rule to detect high volume emails. For example, political campaigns through certain websites may send out emails to organizations in high volumes. Anti-spam engines treat such emails as clean, and do not stop the delivery of these emails.
The syntax of this rule is header-repeats (<target>, <threshold> [, <direction>]), where:
* <target> is subject or mail-from. AsyncOS counts the repetition of values of the target.
* <threshold> is the number of messages with identical values for a given target, received in the last one hour, beyond which the rule evaluates to true.
* <direction> is incoming, outgoing, or both. If direction is not specified in this rule, incoming or outgoing messages are counted for rule evaluation.
Every time when a Header Repeats rule evaluates to true, a System Alert is sent.
Note: If the header field includes comma or semi-colon separated values, the rule considers the complete string for tracking. This rule ignores messages with empty subject header.
The Header Repeats rule maintains a moving sum of messages with up to one minute's precision. As a result, after the set threshold has reached, there can be a delay of one minute before this rule is triggered.
A sample message filter would be as below
header_repeats: if (remote-ip == "IP of exchange server") AND (header-repeats('mail-from', 100)) {
notify ("admin@domain.com");
}
The filter can be modified as per your requirement, the limit 100 would vary depending on what would be considered normal mail flow in your environment.
To get familiarized with working of the ESA I would recommend reviewing the Async OS end user guide.
http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa9-7/ESA_9-7_User_Guide.pdf
Thanks
Libin
