Cisco Ironport C160 is letting in far too much spam after renewing service

[chris.coxe]

(If this is in the wrong community please place it in the correct one.)

I recently renewed my Cisco Ironport C160 for 3 years.  It has been blocking most spam successfully for the past couple of years we've had it.  With it in place we almost never ever got any spam.  So we figured that since it's been so reliable we might as well renew it for more years and get a bit of a discount.  Of course that's when the device decides to let 50+ spam messages a week.  Now I don't know if Cisco is having that much trouble with spam getting passed their Ironport recently but it seems highly suspect that it starts happening around the time we renew our service.  It makes me feel that perhaps this is a way to get customers to upgrade to a newer version of the Ironport.  We paid for a service and I do not believe we are getting it.  Albeit most spam is probably getting blocked but the amount that is getting past is unacceptable and I'm getting daily spam messages forwarded to me from employees.  If we have to upgrade to a new Ironport to get this issue taken care of then fine this can happen as long as two things occur 1) our 3 year contract is able to be used for the newer Ironport and 2) we get a discount on this newer Ironport.  Now, if instead I can receive some assistance in getting my Ironport C160 to work as intended and block spam like it used to then I am well and happy to keep it.  At the moment I am not happy with the service I am receiving from your product.  Perhaps I am not the only one experiencing this issue.  Perhaps I just have a bad configuration that has otherwise proven to work for the past couple years without fail.  I want a working Ironport blocking most if not all spam like it performed in the past.

[chris.coxe]

Thank you for the fast reply and update!  So the C160 is pretty much at the end of its life considering it's not getting the CASE engine 3.4.1 that makes this problem go away.  That's a shame.

http://www.cisco.com/c/en/us/products/collateral/security/email-security-appliance/eol_C51-715394.html

Oh... really wish I had seen that page a long time ago.  We would have replaced our device instead of extending its service.

It looks like CDW is only selling the X70 platform with the closest product being the C170 but you say the CASE engine is still being reviewed for that platform and I'm a bit wary of not knowing how much longer you will be supporting the X70 platform.

So what product in the X80 platform would be closest to the C160 (or C170) in terms of price and capability?  I just want spam blocked and more importantly snowshoe spam blocked.

Edit: I don't see a C180 of any kind.  Is that still in the works?  The closest I see is a 2U rack C380 which was released back in October 2013.  Would that be overkill or is that the closest thing to the C160 or C170 in the X80 platform that you offer?  I mean the difference in price between a C170 and a C380 seems to be about $6000 so that's a tough sale.  How long do you think it will be for the C170 to be updated to the CASE engine 3.4.1 and how much of a lifespan does it have before it stops receiving support?

[Mathew Huynh]

Hello Chris,

With the X80 platform, there is no C180

Only C380 C680 and  vESAs will be offered on the newer platform at this point in time.

I believe the product team are working with offering a hardware upgrade availability for X60 hardware for Cisco Support Contracted users -- however this when available will be updated on the forums.

With regards to EOL of C170's, as I'm not in the office, I cannot readily get this information as yet (if available) so i'll update you if someone else hasn't when I'm back in the office tomorrow.

But I do believe the C170's should have Case engine 3.4.1 pushed out to it -- once again I'll just need to double verify when I get back access to my emails.

Regards,

Matthew

[rajett]

Hi Chris and Matthew,

The C170 is a Cisco device where the rest of the 70 series platforms were OEM devices. This is why the C170 is still actively being sold.

The CASE 3.4.1 engine adds some additional processing loads to the system and the C370/C670/X1070 systems with only 4GB of memory may have problems with the additional load. We're working on a memory upgrade kit for those systems and after those have had some time to spread through the field we'll be provisioning the 3.4.1 engine to those appliances running the 8.0/8.5 code.

In the meantime, if you do not mind running FCS/ED (First Customer Ship / Early Deployment) code then you can ask TAC to provision your serial #s of C170 appliance(s) for the 9.0 code and you will get the updated engine. FCS/ED code must be manually provisioned.

As for licensing, the ESA is licensed differently than the firewalls or other Cisco products. It's by the seat count for the organization no matter the number of appliances you need to handle your organizations email traffic flows.

You can purchase a C170 appliance and the Cisco GLO (Global Licensing Organization) team will activate it with the same licenses you have on your C160. In other words, if you have 8 months left on licenses they will give you a set of keys to activate the C170 for the same time. The appliances need to be tied to the same company name.

[rajett]

Chris,

There is a new upgrade promotion starting for trading in the x60 series appliances for the C170 or the x80 series. They are working through the last steps on the product IDs (SKUs) for ordering.

It requires that you have an active SMARTnet service contract on your x60 series appliance and will run through October 31, 2015.

In the next few days you should be able to order it through your reseller.

Raymond

[dkorell]

Thanks for the upgrade information. Issues with spam filtering on C160s myself brought me here. Can someone validate if CASE engine 3.4.1 is supported on C170's? There was some question about this above.

[chris.coxe]

I'm glad to know that this thread could be helpful to others in the same situation.  It appears that from above you can somehow force the update on the C170s if you meet a certain requirement but I'm not sure.  They seem to indicate that some of the X70 series will have issues with memory with how much more processing the new CASE engine uses in order to prevent snowshoe spam.  I don't know if this applies to all X70 appliances including the C170 or not.  I'm wondering if they all require a memory upgrade purchase of some kind.

My employer and I are concerned that even if we get a C170 there will be some sort of wait time in order to get the necessary CASE update (if we don't meet the requirement to force the update) and that it's going to take too long to wait for the hardware upgrade trade-in program that's been spoken of in this thread.

"It requires that you have an active SMARTnet service contract on your x60 series appliance and will run through October 31, 2015."

We bought our C160 so long ago that I don't know where we bought it from.  Is the SMARTnet service contract the same thing as the three years of support we bought back almost 4 months ago?

Almost 30 garbage domains today alone this is just getting worse:
@casselmemorybooster.com
@hickmanrebates.com
@carsonsoundmgmt.com
@carsonhearclearly.com
@willistaxoptions.com
@willistaxcenter.com
@harvintaxcenter.com
@harvintaxoptions.com
@freemanweightclinic.com
@marshallmenshealth.com
@kingvehiclestart.com
@adamsdatantwrx.com
@harrismenscare.com
@clinstudy.science
@courtshopperexper.com
@slimagainltd.com
@deckerweightclinic.com
@lakesideskincenter.com
@governmentcontractors.mmsend.com
@gainesgetslimcenter.com
@perrymensclinic.com
@suttonmensclinic.com
@savebigamazon.com
@shaffersellsprime.com
@shaffercommerce.com
@kllpnetpath.com
@wiesnetpathway.com
@stienerinternetconnection.com
@haldeckmalesystems.com

[Mathew Huynh]

Hey Chris,

I believe the only requirement (As you're on X60 [C160]) is to be on C170 at the bare minimum for the next CASE update to be available.

As per your contract information, you can reach out to your Cisco Account manager to check the support contract durations -- else we can check it for you if a contract number or Serial number is available (though you may possibly not want to share this on the forum itself).

The SMARTnet contract is the support contract, and if you did renew it a few months ago, i would imagine then your SMARTnet contract would be valid for the duration set at the renewal date.

Thanks,

Matthew

[Mathew Huynh]

Hey Dkorell,

The C170's should be able to upgrade to CASE engine 3.4.1 from what I can tell.

The only devices current restricted to getting to this version is generally the C370/C670 and X1070 which are not running on the required 8GB of Ram which the Product team are working on sorting out.

However C170 on version 7.6.3+ will be able to get the new CASE 3.4.1 engine.

Regards,

Matthew

[dkorell]

Matthew,

We are close to upgrading to the C170's but you kind of say two different things:

"The C170's should be able to upgrade to CASE engine 3.4.1 from what I can tell."

"However C170 on version 7.6.3+ will be able to get the new CASE 3.4.1 engine."

One line says should and the other sounds like it's for sure. Is there anything official you can share that states if we get a C170 that 3.4.1 is available?

[rajett]

Yes, C170s running 7.6.3+ already have the CASE 3.4.1 engine provisioned.

There isn't anything specific posted on Cisco.com regarding this.

The rest of the 70 series (C370, C670, and X1070) are held back to the CASE 3.4.0 engine until we get many of those systems in the field upgraded to 8GB of RAM. The memory kits have already started to be deployed to customers.

Raymond

[Mathew Huynh]

Hello 

I apologise for the misdirected conversation in my last reply.

C170 will indeed have the new CASE engine 3.4.1 if your AsyncOS is on 7.6.3+ as Raymond has confirmed as well.

Thanks,

Matthew

[Jeremy]

For the past year Ironport has not been doing as good a job of catching SPAM. The suspect SPAM engine is not great either, as it flags far too many good messages as SPAM.

I opened a case with Cisco about the issue, but they really do not have a fix other than to turn on suspect scanning and setup a quarantine to filter those messages for review. Someone would have to manually review the quarantine and deliver good messages, which will slow down production. This is a poor solution. SR 634142623

I have used Ironport for the past 10 years and never had as much junk mail problems as the past several months.