Hi Lam,
Emails can be cloned or duplicated using the bcc action on content/message filters. You could bcc emails to a host such as "test@test.local" and it allows you to select the alternate server host IP specific for the bcc action. Do note that the emails being copied cannot be delivered from there to the end recipient as the bcc email would now have a dummy recipient address pointing to domain test.local.
In order to re-route the original traffic completely you could use the "Send to Alternate destination Host" action which would deliver the original emails to the third party hardware. It would then be up to that server to deliver emails to the internet or the internal exchange from that point based on the recipient.
You can read about the details of the action available in the end user guides
www.cisco.com/c/dam/en/us/td/docs/security/esa/esa9-7/ESA_9-7_User_Guide.pdf
Thank You!
Libin Varghese
