cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3721
Views
0
Helpful
2
Replies

IronPort Anti-Spam Scanning: Maximum Message Size to Scan

mychrislo
Beginner
Beginner

What's the reasonable size can be set (beyond the recommended 256k)?

Our incoming clean volume of messages are around 20k - 30k. Model is a single c150.

We found there are messages larger than this size and bypass our anti-spam. Causing some management level users to complain.

How do you guys solve this kind of problem?

Thanks.

Chris

2 Replies 2

Ken Stieers
VIP Advisor VIP Advisor
VIP Advisor

How big are the messages that are slipping through?

Set the limits to catch those...

If that burries the box, hand the bosses the bill for an upgrade to a C3xx...

You'll need to get off the 150 box anyway, its EOL soon...

Currently I've got a C370 (overkill for the amount of traffic we have now...5200 inbound clean messages today)

Its limits are set to scan everything under 1M, don't scan anything over 25M, and scan for up to 120 seconds.

You could also toss those suspect messages over to Cisco to find out why they aren't getting caught as spam... there may be some tweaking that can be done...

My statistics for 2 months logs

# of email unscanned due to ovesized CASE limit

If I double 256k to 512k. 30% of those unscanned emails can be scanned

If I go to 800k, ~50%.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers