Email Security C380 Deployment Questions

[milin160791]

Hi Team,

I am going to deploy Two Email Security C380 new boxes at one of our customer place. 

It is DMODE Enabled Appliance with Bounce Verification & CCS-MESSAGING Licenses. ( For Outbound Only)

I have some doubts please help me to make it clear.

•  Is it UCS Box  or particular Cisco ESA Hardware? 

•  How to Configure ESA for Mass Mail Delivery ?  (Configuration Example will be helpful)
•  How to Deploy ESA with Multiple Interfaces for Outbound?   (Config. Example Required)
•  How to Deploy both ESAs in HA ?  (( Clustering Example))

Thanks.

[Jernej Vodopivec · Accepted solution]

1. This is specially configured Cisco UCS C240 M3 server under the hood.

2. Customize the Mail Flow Policy: "Mail Policies" -> "Mail Flow Policy" and customize parameters like Max. Messages Per Connection; Max. Recipients Per Message; Max. Recipients Per Hour: etc. These values depends on

You can find detailed information how to create Mail Flow Policy and link it to HAT here:

http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa8-6/ESA_8-6_User_Guide.pdf

You have D-MODE license so you can use Mail Merge feature for sending mass mails also: take a look at chapter 40-4 how to do it.

3. What would you like to achieve with multiple outbound interfaces?

4. You can have HA by creating cluster (you don't need separate license). Create cluster by "clusterconfig" CLI command. I'd recommend to create cluster using SSH over CCS.

By configuring cluster you'll get configuration synced between both appliances. Logs, reportings and spam quarantine will still be at appliance level.

If you'd like to have centralized reporting, message tracking etc. you'll need Security Management appliance also.

You can find more information in Chapter 38.

[milin160791]

Dear Jernej,

--> So, the initial configuration will remain the same as we are doing on C370
(Connect direct Management Interface and give our PC to 192.168.42.x/24 IP and so on..)   or    this one is UCS 240 M3 so that we need to do some extra stuffs. ?

-> I have already seen chapter 40-4 for Mass Mail Delivery but still confused with configuration part please help me with this.

-> Customer want me to deploy the box Using Multiple interface ( Like Data1- for Incoming mails from internet and Data2- for Outgoing Mails from lan. He wants to deploy ESAs for Outbound Mail Traffic only so is it good to Use Multiple Interfaces with this requirement ?

- In Cluster Environment, will it work like (Active/Standby or Active/Active) ?  

Also, only the Policies part will going to push from one appliance to other  or  Network Configuration will also pushed from one to the other ?
 ( Meaning Can we use different subnet on both devices while putting it in HA)

Thanks

[Jernej Vodopivec · Accepted solution]

Hi!

> So, the initial configuration will remain the same as we are doing on C370
(Connect direct Management Interface and give our PC to 192.168.42.x/24 IP and so on..)   or    this one is UCS 240 M3 so that we need to do some extra stuffs. ?

No, you don't need to do any extra stuff. Forget that this is UCS server underneath :)

> I have already seen chapter 40-4 for Mass Mail Delivery but still confused with configuration part please help me with this.

Please tell me more about the requirements and what are you trying to achieve and I'll try to help you.

> Customer want me to deploy the box Using Multiple interface ( Like Data1- for Incoming mails from internet and Data2- for Outgoing Mails from lan. He wants to deploy ESAs for Outbound Mail Traffic only so is it good to Use Multiple Interfaces with this requirement ?

Yes, no problem at all.

Menu "Network" > "IP Interfaces" &  "Network" > "Listeners"

Create interface (public listener and connect it to WAN) and create second interface (private listener) and connect it to LAN.

See example on page 5-4: http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa8-6/ESA_8-6_User_Guide.pdf

> In Cluster Environment, will it work like (Active/Standby or Active/Active) ?  

Both appliances work at the same time - it's Active/Active cluster. Both appliances work as if they were in standalone more, only the configuration is synchronized.

> Also, only the Policies part will going to push from one appliance to other  or  Network Configuration will also pushed from one to the other ?
 ( Meaning Can we use different subnet on both devices while putting it in HA)

Network configuration is not synchronized. Policies, filter etc. are synchronized only.

[milin160791]

Hi Jernej,

Thanks for your reply.

- I don't have a particular requirement for Mass Mail Delivery right now, but still I want to know that in which different ways we can configure this feature?

- How we can configure Bulk Mailing please explain in little brief.

-  If you can share an Implementation Document any of the ESA Device that will be great help.

Thanks.

[Jernej Vodopivec]

Hi,

the point with IPMM is that you:

- don't generate thousands or millions of email messages with some email marketing software running on your PC but instead you define message template on the ESA itself and then generate and send emails based on the template message to email recipients with all workload done by ESA; so ESA will replace placeholders in email templates with real values and then send email to recipient; something like mailmerge function in Word

- that also helps minimize resources consumption because ESA doesn't have to process thousands SMTP connections

You can contact your favorite Cisco partner and ask them to provide you example libraries which Cisco created for this purpose. Cisco created these libraries in different common programming languages so just pick up one best suitable for you.

But on the other hand - you don't need to use IPMM for mass delivery at all if you don't need to - you can still generate emails in your favorite bulk email software which sends emails to ESA. ESA then delivers these emails to recipients - as standard MTA.

[milin160791]

Dear Jernej,

Thanks for your reply.

As I would like to ask you some questions one to one , can I have your skypeid or some personal id? (if you don't mind :) )

Thanks.

[Jernej Vodopivec]

Hi, send me your skype ID and I'll add your contact.

If possbile please send questions to support forums so others could have benefit of the discussion.

[milin160791]

Hi,

My Skypeid is milin1607

I will post here..whatever we will discuss.

Thanks.

[milin160791]

Hi Jernerj,

Thanks a ton for your all support.