Easy question about Content Filtering

[Fabio Bustamante]

Hi, I don't have too much knowledge about Cisco ESA, and I'm currently trying to understand some ways of operation. Specially content filters.

When we associate content filters to a Mail Policy, does the order matter? Does the ESA start to check in a top-down order each content filter that is enabled? (and perform all the actions that are associated to each filter as long as it matches the condition?)

And if that is true, how can I create only one filter and stop in that filter? Would I have to place it at the top and then create an action that says something like "stop here, skip the rest and deliver now"?

[Mathew Huynh · Accepted solution]

Hey Fabio,

The ordering matters as we do take a top down approach and whichever conditions match the action will be taken.
Keeping in mind, if the action is not marked as (Final Action) that means it'll apply that action and go down to the next content filter accordingly until the list has finished and apply any actions when conditions are met.

You can create the filter and put "skip remaining content filter" as the second action within it- this way it does the first required action and skips any other content filter -under- it within the order. (assuming you have applied many content filters per mail policy).

I hope this answers the query.

Thanks,
Matthew

[Fabio Bustamante]

Yes Mathew, thanks a lot.

I just had this scenario, where there is an Outgoing Mail Policy that has something like 20 Outgoing Content Filters. And one of those filters doesn't have any condition and the action is <sent the mail to an specific SMTP Server> So, basically, any mail that matches this Policy is always sent to this SMTP.

So, I want an specific mail (comming from an specific IP) to not be sent to that SMTP Server. So I guess I could place a new Content Filter at the top with a condition for that mail and an action that forces to skip the remaining filters.

In that case, I suppose ESA will try to deliver the mail in a normal way, by resolving the destination domain (MX register) and we will avoid redirecting it to the SMTP Server

Fabio