Cisco ESA - How to remove [EXTERNAL] for incoming emails?

[jamie6910]

Hey guys. I am having trouble on how to remove the [External] from an incoming emails? Is there any possible way to create a condition to only remove the [External] for any emails reply to "@popcorn.com.my"
 only. As attached is the rule and condition for my filter.

I am very new with this Cisco ESA environment. Hope can have a firm explanation.  

[Ken Stieers]

Do you know if your ESA is adding those stamps, or are they hitting the ESA with that in the subject line?

[jamie6910]

Are both thing is different? I am not sure about that. Do you have any work around of these situation you mentioned?

[Ken Stieers]

If the mail is being stamped as external by the ESA, you just turn that off...
If its coming in from some other system that's stamping it as external, you create a content filter or message filter to modify subjects with external in it.
The easiest way to tell is to go to an external email provider (yahoo, gmail, whatever), send yourself an email with a distinctive subject.
Then in the ESA gui, go to Monitor/Message Tracking and search for that email. Click on Show Details on the right and it will show a bunch of detail as the mail gets processed by the ESA.
Look for "original subject on injection"... that will tell you if it CAME in stamped or if the ESA is stamping it.

[jamie6910]

Oh i see. I will try this first.

---

@Ken Stieers wrote:
Then in the ESA gui, go to Monitor/Message Tracking and search for that email. Click on Show Details on the right and it will show a bunch of detail as the mail gets processed by the ESA.
Look for "original subject on injection"... that will tell you if it CAME in stamped or if the ESA is stamping it.

---

---

On this workaround, can we also detect where the EXTERNAL being stamped?

[Ken Stieers]

Maybe... it depends on how it was done, and if someone added logging for it.

[jamie6910]

Hi Ken, 

Have you ever encounter the issue where the email subject have this "RE:[External]" and it keeps appending whenever the email trails continues. 

Other than that, is there any way we setup to automatically remove the  incoming banner when replying or forwarding emails to sender?

[Ken Stieers]

I have seen email chains where one side keeps prepending an extermal stamp.

Usually the easiest way to handle it is to do a search and replace on the subject of all incoming mail, replacing [external] with nothing, then stamping it fresh.

[jamie6910]

Oh meaning that there is no workaround to disable it inside the ESA? on where we first time setup it to be [EXTERNAL]? 

[Ken Stieers]

Im so confused...
Are you saying you ESA is configured to stamp and you don't know where/don't know how to turn it off?

[charella]

Q: Have you ever encounter the issue where the email subject have this "RE:[External]" and it keeps appending whenever the email trails continues.

Other than that, is there any way we setup to automatically remove the incoming banner when replying or forwarding emails to sender?


A: If I understand the question: you have a repeated Subject value of [External] added on inbound mail. If the mail thread is exchanged multiple times with the outside party, then [External] get’s added multiple times to the same subject.
If that is correct:

* Configure this in a content filter. Most likely outbound so it is not present upon a reply.

* You will need to determine the exact criteria to match. It could be all outbound messages or only a select amount.
* Add an action > Add/Edit Header

* Search & replace from the Value of Existing Header:

* Search for: (?i)\[External\]
* The next line – Replace with: (leave this empty)



* Alternatively the below string would be used in a message filter.

* edit-header-text("Subject", "(?i)\\[External\\]", "")

Please test this prior to implementation to production.

* One method to test/verify is to add the condition of your own email within the content filter.

* This would control the content filter to only you.
* Then you could add the value and send to your gmail/yahoo… then reply a few times.
Thank you,
Chris