Guidance on configuring some mail rules

[ihateoov]

Hi guys,

i have received a task for a customer to deploy Cisco ESAv c100v which will replace current email gateway.

I have made initial installation and the appliance is up and running on IP 10.1.1.20 (interface for inbound and outbound mail).

My test domain for example is adonet.com in which i have some users and mail server for that domain on IP 10.1.1.80.

Email's work internally between users but i need guidance on how to configure rules for incoming and outgoing mails.

Examples:

1. If mail comes from IP 10.1.1.30 how to re-route it to DLP appliance on IP 10.1.1.50 ?

2. If mail comes from the DLP appliance to ESA, disable anti-virus and anti-spam check on it and check for header and if in header is „X-RCIS-Action: QUART“ throw it in quarantine, otherwise forward it to the recipient ?

3. Disable compliance (ex. for certain senders don't do antispam) outbound for certain senders and don't forward it to DLP appliance for analysis ?

There are more tasks like this that i need to fulfiill so if anyone has some guides or practices on how to, please let me know.

I am new to Cisco ESA. :)

Kind regards

[marc.luescherFRE]

Hi there,

we have such a setup but are using inbound and outbound appliances so it is much easier.

Let me try answering your questions one by one:

a) we use a filter like this to give you some idea, but you would use the option of alternate hosts to sent to your DLP appliance

GUI_Trap_CodeGreen: if (header("Received") == "CGN-CA-MTA") AND (header("X-IronPort-InternalRelayed") == "1") AND (header("X-IronPort-Fwd-CG") == "1") { duplicate-quarantine("TrapCodeGreenMTA"); log-entry("SMTPLoadBalancerNew"); alt-mailhost ("mv1.fmcna.com"); }

in your case it would be just a message filter like:

GUI_FWD_to_DLP: if (true) { alt-mailhost ("[10.1.1.50]"); }

b) for the other two options I would create two more policies

Whitelisted User and Systems

Here you would disable Greymail and Antispam checking

Disabled DLP

Here you would all systems but under message filters you would disable the message filter GUI_FWD_to_DLP so this filter would not take action

A filter to do what you asked for would be like

GUI_XHEADER_PVO: if (header("X-RCIS-Action") == "QUART") { quarantine("TrapCodeGreenOut"); }

c) I assume you are using a single message interface on your ESA. You have now two option you either create another filter checking for the presence of the x-header and and bypass forwarding or you create a second private interface on on appliance with port 2525 and ask your DLP appliance to forward all outgoing email to that IP and port for processing. That way you can define per interface what should happen. What you need to be carefull is that you are not creating a huge message loop, meaning that messages are always sent to DLP and back to the ESA without going to your final mail system.

I hope that helps to get started.

-Marc

[ppreenja]

Hi There,

Please find below details which might be able to assist you with your requirement:

1. If mail comes from IP 10.1.1.30 how to re-route it to DLP appliance on IP 10.1.1.50 ?

- You can use below message filter:

RedirectDLP:
If (remote-ip == "10.1.1.30")
{
Alt-mailhost('[10.1.1.50]');
}
.

Below is the article for assisting you in adding the message filter:
https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118145-technote-esa-00.html

2. If mail comes from the DLP appliance to ESA, disable anti-virus and anti-spam check on it and check for header and if in header is „X-RCIS-Action: QUART“ throw it in quarantine, otherwise forward it to the recipient?
- For the above you can use below message filter:

DLP_CATCH:
If ((remote-ip == "10.1.1.50") AND header("X-RCIS-Action: QUART"))
{
skip-spamcheck();
skip-viruscheck();
quarantine("Policy");
}
.

3. Disable compliance (ex. for certain senders don't do antispam) outbound for certain senders and don't forward it to DLP appliance for analysis?
If my understanding is correct for the above query below message filter will be able to assist you.

Create a dictionary named "SENDERS_SKIP" and add all the senders to be skipped.

Compliance_SKIP: if (mail-from-dictionary-match ("SENDERS_SKIP"))
{
skip-spamcheck();
skip-filters();
}
.

Note: Please add this filter above in order from the "DLP_CATCH" filter.

I hope the above helps!

Cheers,
Pratham

[ihateoov]

Thanks for the tips.

As i understand this filters are separate from the GUI content filters for incoming and outgoing mail?

If i make this rules via CLI how can i see them in GUI ?

[ppreenja]

Hi,

These rules will only be visible/editable via CLI of the ESA appliance. You can only see the hit counts of the message filters via GUI by going to Monitor-->Message Filters.

Cheers,
Pratham

[ihateoov]

Can you tell why rule for big mails: ex.

AllowBigMails:
if ((mail-from == '(?i)tester@dlp.hr') AND (body-size > 10M)){
deliver();
}

is not working ?

I get reply

Error Type: SMTP
Remote server (10.1.1.20) issued an error.
hMailServer sent: .
Remote server replied: 552 #5.3.4 message size exceeds limit
The message size is set to 10 MB by default.

[marc.luescherFRE]

Hi there,

I am suspecting that your default mail flow policy specifies a max message size of 10 MB (Mail Flow Policy, Default settings, connection, Max Mail Size).

A message filter will only action on emails which have passed the mail flow policy. If you need to allow > 10 MB then you would need to increase the value and turn your filter logic around and block > 10 MB for every other sender.

I hope that helps

-Marc

[ihateoov]

You are right i am using default value of 10 MB.

Can you give me example how to make exception if i increase max value to 50 MB and for most users to send max will be 7 MB and for certain senders above 10 MB ?

Thanks.

[marc.luescherFRE]

You have multiple options and all depends on how many users you are having.

For a small user basis or to get started quickly:

a) create a dictionaries with all user not allowed for 10 MB emails

     Enter the firstname.lastname@domain.com email address of authorized users, line break for second user etc.

b) create a content filter like

    GUI_Block_LargeFile

    if   Message Size                     body-size > 7340032     

         Envelope Recipient            rcpt-to-dictionary-match("Users7MBLimit",1)

         Make sure to select apply rule Only if all conditions match

        Quarantine                          quarantine("Policy")

  c) Submit

  d) Activate content filter in default mail policy.

  This will work, should your Ironports be connected to your LDAP or AD directory you could also create a group there and modify the filter to do a LDAP group lookup for membership instead.

I hope that gets you started.

-Marc

[Mathew Huynh]

Adding onto of Marc's comments;

If you have set the limit on mail flow policies to 50MB (please only do this for certain mail flow policies / sendergroups or you may open your device to some trouble down the line).

You can create a message filter (i would prefer this over content filter simply because we can enforce it earlier before subjecting the email to further scans) to use of a rule for the domains which you trust and want to allow big sized emails to be put through, where every other sender domain will be dropped.

EG:

You want to allow @cisco.com to send 50mb only, everyone else should be dropped.

Filter_rule:
if mail-from != @cisco\\.com
{
if body-size > 7340032
{
drop();
}
}
.

This means, if the sender is NOT @cisco.com and it's larger than a restricted size, drop it. (this is a silent drop so senders will not know their emails got dropped, you can change this accordingly if required).

Alternatively - if the domains you trust, you know their mail server information, a better option is to create a new mail flow policy which allows 50MB; apply it to a special sendergroup for large_emails
Then within this sendergroup, insert the IP of the sending host or partial hostnames if they have multiple servers used to connect to your ESA.

Last thing to note.
You can set a limit to 10MB for example, but this 10MB also includes the MIME inflation.
So an email of 10MB may have a MIME inflation that pushes it to 13.4MB and gets rejected by the ESA.

What this means is a 50MB limit on the mail flow policy, may allow emails in actual size of 33MB (accounting for approx 34% MIME inflation).

Regards,
Mathew