Filter for particular file Extensions

[Startrek4u_ironport]

We just purchased an Ironport C150 and are in the process of testing it out and getting our setup completed, one of the things we want to do is reject incoming mail if an attachment has a certain file extension to it (ie, .bat but we have about 20 or so we want to reject). I can't seem to figure out how to get that accomplished and the documentation doesn't seem to help much, can anyone point me in the right direction to do this?
Thanks.

[cireland_ironport]

Go to the "Mail Policies" Tab, and drop down to "Incoming Content Filters".

[img:d98a04f180]http://users.ctinet.net/cki/ironport/post1/1.jpg[/img:d98a04f180]

On the "Incoming Content Filters" window, hit the "Add Filter" button.

[img:d98a04f180]http://users.ctinet.net/cki/ironport/post1/2.jpg[/img:d98a04f180]

Give the filter a name then hit the "Add Condition" button.

[img:d98a04f180]http://users.ctinet.net/cki/ironport/post1/3.jpg[/img:d98a04f180]

Drop down to "Attachment File Info" on the left hand side. You can add a condition based on Filename, but I recommend File Type. It's up to you.

[img:d98a04f180]http://users.ctinet.net/cki/ironport/post1/4.jpg[/img:d98a04f180]

Once you add the condition hit the "OK" button. * You can add multiple conditions / attachments if you'd like. Make sure "Apply Rule" drop down is set to "If one or more conditions match".

[img:d98a04f180]http://users.ctinet.net/cki/ironport/post1/5.jpg[/img:d98a04f180]

After you are done adding the conditions, hit the "Add Action" button.

On the "Add Action" window, drop down and select "Drop (Final Action)" or "Bounce (Final Action)" to reject the incoming emails based on the conditions you set. Then click the "OK" button.

[img:d98a04f180]http://users.ctinet.net/cki/ironport/post1/6.jpg[/img:d98a04f180]

Your new filter will be added, don't forget to submit and commit your changes!

[img:d98a04f180]http://users.ctinet.net/cki/ironport/post1/7.jpg[/img:d98a04f180]

[Douglas Hardison]

( cireland: cool screenshots :) )

Startrek4u:

I just wanted to add for clarification, that you need to make sure that you apply the content filter to a mail policy.

For instance, if you want to block *inbound* attachment types, create the content filter as cireland described, and then browse to Mail Policies -> Incoming Mail Policies.

The mail policies screen is laid out similar to a spreadsheet. Click on the 'cell' under the Content Filters column for the policy to which you would like to apply this filter.

There, you can specify via checkboxes, which filters you want enabled for that policy.


-whardison

[jlwaller_ironport]

Also don't forget to apply it to a mail flow policy that the mail will actually apply to if using multiple mail flow policies.

The ironport will do a first match on mail flow policies, so if you have multiple policies setup and you want to block only for one of them, make sure you have your policies ordered properly so that it will apply it.