How to block specific email address on C160 7.0.1-102

[Mike Baker]

Hello.  I need to know how to block a specific email address on an ironport c160 running 7.0.1-102 version.  I thought there would be blocklist under options tab, but I do not have that.  Not sure how to do it.  Thank you for the help.

Mike Baker

[jgandla]

Greetings Mike,

We have a very good KB article that describes steps on how to block an email address:

How do I block a sender's email or email addresses?

Knowledge Base Answer ID: 1343

http://tinyurl.com/cnreax

Hope this information helps.

Regards,

------------------------------------------------

Jyothi Gandla

Customer Support Engineer

Cisco IronPort Customer Support

.:|:.:|:.

c i s c o

[Mike Baker]

Thank you for the reply.  I see that both of the c160's have a filters area, that is accessable from

the cli interface.  Here is what is there:

 
block_harrasing_user: if mail-from == "openlineblog@gmail\\.com" {
                          drop();
                      }
block_tarzian: if mail-from == "wt0863@gmail\\.com" {
                   drop();
               }
Block_SeeRickRun: if mail-from == "seerickrun@gmail\\.com" {
                      drop();
                  }
block_jainjain: if mail-from == "jainjain2000@yahoo\\.co\\.uk" {
                    drop();
                }
Block_publiccourt: if mail-from == "publiccourt@yahoo\\.com" {
                       drop();
                   }
Block_orillious: if mail-from == "orillious\\.film@gmail\\.com" {
                     drop();
                 }
 

Would I block and email address from there?  This almost looks like the person who managed the ironports before me may have done this filter syntax to block a specific user.  I just want to make sure I block the email address the correct way.

Thanks.

Mike Baker

[viahmed]

Hi Mike,

You can block an email address via CLI (message filter) or GUI, both works fine. The article Jyoti provided explains using GUI. Please follow the step by step procedure in the article if you want to go with GUI option or do following to block it via message filter.

===================

Email_gateway> filters

Choose the operation you want to perform:
- NEW - Create a new filter.
- DELETE - Remove a filter.
- IMPORT - Import a filter script from a file.
- EXPORT - Export filters to a file
- MOVE - Move a filter to a different position.
- SET - Set a filter attribute.
- LIST - List the filters.
- DETAIL - Get detailed information on the filters.
- LOGCONFIG - Configure log subscriptions used by filters.
- ROLLOVERNOW - Roll over a filter log file.
[]> new

Enter filter script.  Enter '.' on its own line to end.

block_email_filter:
if mail-from == "username@domain.com"
{
drop();
}
.
1 filters added.

Choose the operation you want to perform:
- NEW - Create a new filter.
- DELETE - Remove a filter.
- IMPORT - Import a filter script from a file.
- EXPORT - Export filters to a file
- MOVE - Move a filter to a different position.
- SET - Set a filter attribute.
- LIST - List the filters.
- DETAIL - Get detailed information on the filters.
- LOGCONFIG - Configure log subscriptions used by filters.
- ROLLOVERNOW - Roll over a filter log file.
[]>

Email_gateway> commit

Please enter some comments describing your changes:
[]> block email address filter added

Changes committed: Fri Feb 25 14:55:30 2011 GMT-8
Email_gateway>

===============================

Hope I made it clear for you.

Cheers,

Viquar

Support Engineer