Cisco ESA - How to remove [EXTERNAL] for incoming emails?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
09-15-2021 05:01 AM
Hey guys. I am having trouble on how to remove the [External] from an incoming emails? Is there any possible way to create a condition to only remove the [External] for any emails reply to "@popcorn.com.my"
only. As attached is the rule and condition for my filter.
I am very new with this Cisco ESA environment. Hope can have a firm explanation.
- Labels:
-
Email Security
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
09-15-2021 06:36 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
09-15-2021 06:40 AM
Are both thing is different? I am not sure about that. Do you have any work around of these situation you mentioned?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
09-15-2021 07:08 AM
If its coming in from some other system that's stamping it as external, you create a content filter or message filter to modify subjects with external in it.
The easiest way to tell is to go to an external email provider (yahoo, gmail, whatever), send yourself an email with a distinctive subject.
Then in the ESA gui, go to Monitor/Message Tracking and search for that email. Click on Show Details on the right and it will show a bunch of detail as the mail gets processed by the ESA.
Look for "original subject on injection"... that will tell you if it CAME in stamped or if the ESA is stamping it.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
09-15-2021 07:19 AM
Oh i see. I will try this first.
@Ken Stieers wrote:
Then in the ESA gui, go to Monitor/Message Tracking and search for that email. Click on Show Details on the right and it will show a bunch of detail as the mail gets processed by the ESA.
Look for "original subject on injection"... that will tell you if it CAME in stamped or if the ESA is stamping it.
On this workaround, can we also detect where the EXTERNAL being stamped?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
09-15-2021 07:22 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-20-2021 11:02 AM
Hi Ken,
Have you ever encounter the issue where the email subject have this "RE:[External]" and it keeps appending whenever the email trails continues.
Other than that, is there any way we setup to automatically remove the incoming banner when replying or forwarding emails to sender?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-20-2021 04:15 PM
Usually the easiest way to handle it is to do a search and replace on the subject of all incoming mail, replacing [external] with nothing, then stamping it fresh.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-20-2021 07:45 PM
Oh meaning that there is no workaround to disable it inside the ESA? on where we first time setup it to be [EXTERNAL]?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-20-2021 08:37 PM
Are you saying you ESA is configured to stamp and you don't know where/don't know how to turn it off?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-23-2021 10:10 AM
Other than that, is there any way we setup to automatically remove the incoming banner when replying or forwarding emails to sender?
A: If I understand the question: you have a repeated Subject value of [External] added on inbound mail. If the mail thread is exchanged multiple times with the outside party, then [External] get’s added multiple times to the same subject.
If that is correct:
* Configure this in a content filter. Most likely outbound so it is not present upon a reply.
* You will need to determine the exact criteria to match. It could be all outbound messages or only a select amount.
* Add an action > Add/Edit Header
* Search & replace from the Value of Existing Header:
* Search for: (?i)\[External\]
* The next line – Replace with: (leave this empty)
* Alternatively the below string would be used in a message filter.
* edit-header-text("Subject", "(?i)\\[External\\]", "")
Please test this prior to implementation to production.
* One method to test/verify is to add the condition of your own email within the content filter.
* This would control the content filter to only you.
* Then you could add the value and send to your gmail/yahoo… then reply a few times.
Thank you,
Chris
