Cisco ESA Remote Server Returned Error 552 Size Limit Exceeded

[fabc1]

Dear all,

i would need some helps regarding an issue on Cisco ESA C390.

we are having issue when no notification has been triggered nor send to recipient when an email has been sent from external with attachment size more than 40MB, although configuration has been set for recipient to receive notification when email exceeding size limit. and remote server returned an error 552 size limit exceeded.

not sure why it didn't trigger the notification to recipient tho. appreciate any idea or advice on this. Thanks!!

[dmccabej]

Hello,

To confirm ...You're saying the recipient is not receiving any form of notification? What do you have configured to send out these notifications? Also, can you provide a copy of the mail logs showing these rejections due to size limits being exceeded?

Thanks!

-Dennis M.

[fabc1]

Dear Dennis,

Thank you for responding to this question. yes, the recipient didn't received notification. below image is how we setup it. hope the image is clear enough for you to see.

 

btw, we unable to share the copy of mail log because we could not find it in the mail log but based on previous experience this user normally will send big attachment and also, why ESA message tracking does not show this sender email?

Thanks!

[UdupiKrishna]

This looks alright. As long as the message size is/was greater than 40 MB, provided the content filter is used in the correct mail policy it should have triggered.

Few things to look for, message tracking to verify the actual size of the email (MID <XXX> ready <xxxxxxxx> bytes).

The policy which processed the email (can be found in message tracking (and if it that specific policy has this content filter selected)

[dmccabej]

The filter seems to be fine. Though, do you know what Mail Flow Policy these messages are hitting? Because there is also a Max. Message Size limit configured on the Mail Flow Policies. And if these connections are getting rejected during the SMTP conversation, then the email would not enter the ESA pipeline and not be processed by that Content Filter. Which, would then explain why your recipient is not being notified.