Ironport C350's in cluster, have to search both to find email's to release

[parnelllutz]

I have two c350's in Cluster on os 7.3. When a user asks to have a email released (quarantined) I have to search both units to find it. For example it could be on ironport01 or ironport02. There is a spam search, but these are not spam emails, these are ones that have been quarantined and I released them, for example audio file attachments. If this is just the way it is, thats all I need to know. Maybe in cluster they have to be the same name?

Thanks

[viahmed]

Hi Parnell,

The quarantines other than spam quarantine (e.g. policy quarantine) are always on the same box. You can only configure spam quarantine in centralized option.

Hope this helps!

Regards,

Viquar

CSE

[parnelllutz]

  Ah so I have 2 ironports, in cluster, but quarantined email will go to only 1 of them. Which means I may need to search both to find the 1 email I am looking for. I figured in cluster mode there may of been a way to search that included both appliances. 

[Andreas Mueller]

Hello Parnell,

clustering on Cisco IronPort means to synchronise the configuration of two or more appliances, while  their features, logs, reporting, quarantines etc still run independendly on each appliance. To maintain these features centralized as well, you'd need an SMA (M-series), which provides centralized tracking and reporting for all appliances.

Regards,

Andreas

[parnelllutz]

Thanks Andreas,

We do have a M650 device, but like you state, it runs centralized tracking and spam, but is not able to search the stored emails on the 350's...I guess that has just confirmed my own theory, that I will still need to search both c350 to find emails to release.

I appreciate the input to clairify my question.

[viahmed]

Hi Parnell,

If you have a management device (M650) than you need to enable the external spam quarantine on C-series boxes to take advantage of single quarantine box. All the quarantined messages from both C series will be pushed to your M650 where you can release and manage them easily.

Please check and enable the external spam quarantine on C series, GUI-->Security Services-->External Spam Quarantine.

I will recommend you to open a support request with us to be safe side if you are not familiar of the product and need further guidance.

Thanks,

Viquar

[parnelllutz]

Well the thing is, the emails I am referring to aren't spam. They are just emails with attachments that get quarantined and we have our clients request they be released. So from what I read it is a separate quaratine. The spam quaratine is already enabled and I can search it, but it finds spam emails, which I am not looking for and the emails I need to release are not located in.

[jgandla]

Greetings Parnell,  Are these messages already in Policy Quarantine? If yes, then you as an administrator can only release them for the user. In future for new emails, if you want users to release them the messages when hit by a content filter, you can divert the messages using a content or message filter to IronPort Spam Quarantine.   Here are the KB articles you can refer to for this information:  Can a Content Filter divert messages to the IronPort Spam Quarantine? http://tinyurl.com/coebj3  Can a Message Filter divert messages to the IronPort Spam Quarantine? http://tinyurl.com/s2eql  Hope this information helps. Please let us know if you have any questions.   Thanks, Jyothi Gandla Customer Support Engineer