Easiest way to block spam adresses on an Ironport C170?

[oakwall77]

A customer of ours wants to block a certain sender. SL/BL is, for some reason, currently disabled. I am quite new to Ironport but from what I can find via Google, Safe List/Block List should be the easiest way? Can anyone think of any reasons for not having it enabled? Pro's/con's?

Thanks

..Andreas

[Ken Stieers]

Since the SafeList/Block list has to be maintained by the users via their login to the quarentine, and some people don't use that, they just mark the mail and let the mail client file it appropriately, it may not be turned on.

It does take an extra step to backup and restore it when you do upgrades, so maybe they avoided it... Or maybe they just didn't know about it...

In my environment I don't see a lot of con's... pro's are that you don't have to maintain the list other than backup/restore when you do upgrades...

Ken

[oakwall77]

Would this be the only way to do it? We don't have a lot of spam block requests, so I think we're going to keep it centralized, if possible. Worst case, I guess we could activate it and do it ourselves anyway? Or is it connected to that affected account only?

[Enrico Werner · Accepted solution]

Hi Andreas,

when your customer wants to block all messages from a certain host, then blocking the IP address via BLACKLIST is the way to go:

Article #158: How do I blacklist a malicious or problem sender? Link: http://tools.cisco.com/squish/a1542

Otherwise, single email addresses or domains can be blocked using mail policies and/or filters:

Article #1237: How to create an envelope sender-based blacklist Link: http://tools.cisco.com/squish/8107a

Best regards,

Enrico

[oakwall77]

Thanks a lot!