Ironport AMP

[jtsai8585]

Seems like there are two features for Ironport ESA that are both called AMP?

1. Antivirus Malware protection

2. Advanced Malware Protection (sand boxing for zero day protection)

We already have #1.   What is the part number for #2?

[Libin Varghese]

Hi,

AMP is a comprehensive malware-defeating solution that supports enhanced file reputation capabilities, detailed file behavior analysis (sandboxing) and reporting, continuous file analysis, and retrospective verdict alerting.

Licensing part ID is ESA-AMP-LIC=

I would recommend contacting your Cisco sales rep to get information on the licenses.

AMP consists of two features, file reputation and file analysis which are licensed as part of the above part ID.

Antivirus are Sophos or McAfee.

Please refer to the below guide for licensing orders

http://www.cisco.com/c/en/us/products/collateral/security/email-security/guide-c07-736692.html

Thanks

Libin Varghese

[jtsai8585]

We alredy have Sophos + McAfee + AntiMare.

Are you saying the second part of AMP, Advanced Malware Protection (sandbox and cloud analysis for doc, pdf,......) is the same part number?  I highly doubt it.

I'm being quoted for part number WSA-AMP-LIC but looks like this is for Web filtering not for ESA.

[Libin Varghese]

Hi,

I'm not sure what feature you mean by AntiMare, can you share the complete name for that from the WebUI System Administration -> Feature Keys.

Sophos and McAfee are part of the AntiVirus feature.

AntiMare is not a known feature on the ESA.

Thanks

Libin

[jtsai8585]

Antimalware.... I think it's Antispam and Antivirus not Antimalware.... the feature keys does not list anything that says AMP or Anti malware...

So if i'm understanding you correctly, the same part id you've mentioned contains two parts.

1. AntiVirus / AntiSpam

2. Advanced Malware Protection.

If that is the case, am I getting the wrong part number from our Cisco sales WSA-AMP-LIC ?

[Libin Varghese]

Hi,

Advanced Malware Protection appears in the available feature keys as File Reputation Service and File Analysis Service, attaching screenshot from my lab device.

Antimalware could be anti-virus you are referring to, however they are also listed and referred to as Sophos or McAfee.

- Libin

[jtsai8585]

Thanks.  Back to the original question, the File Analysis and Reputation you've highlisted would be the AMP for the ESA and the part number you've provided is "Licensing part ID is ESA-AMP-LIC=".

So the quote I've got is incorrect from our Cisco rep ? (WSA-AMP-LIC)

[Ken Stieers · Accepted solution]

Correct, that part number you have (WSA-AMP-LIC=) is for the Web Security Appliance.

[Libin Varghese · Accepted solution]

Correct, as mentioned by Ken.

Email Security Appliance (ESA) and Web Security Appliance (WSA) are both referred to as Ironport so could have been mixed up.

-Libin