Buy or Renew
Buy or Renew
Duo Security forums now LIVE! Get answers to all your Duo Security questions. Learn more
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
7438
Views
15
Helpful
7
Replies

IronPort Feature Keys Expiration

spisipati
Level 1
Level 1

‎08-11-2017 10:10 AM

I am new to IronPort and having below queries. Please help,

1. If Feature Keys expired, how the IronPort works?

Feature Keys : 

Outbreak Filters
IronPort Anti-Spam
Sophos Anti-Virus

Do mails go through IronPort, with latest available configuration at the time of expiry (or)

All mails will be blocked / bounced.(or)

Any other...

2. If Management Server crossed its EOL and Feature Keys Expired too, Do management server works?

Feature Keys :

Cisco IronPort Spam Quarantine
Cisco IronPort Centralized Web Configuration Manager
Cisco Centralized Email Reporting
Cisco IronPort Centralized Email Message Tracking

If Yes, at what level... Can we use this server for message tracking and Spam Quarantine

If No, how to do 'message tracking'

2 people had this problem
Labels:
0 Helpful
7 Replies 7

Libin Varghese
Cisco Employee
Cisco Employee

‎08-11-2017 10:28 AM

1. If feature keys for a scanning engine expire, that particular scanning would not function. Email flow uses "Incoming Mail Handling" feature key. As long as that is active, mail flow would still work.

2. If the feature keys on the management server expire it would no longer accept reporting and tracking information from the ESA. No new data will be sent to the SMA, and the historical data will become unavailable, so the end users will not be able to access their quarantines.

Regards,

Libin Varghese

pbabu6001
Level 1
Level 1
In response to Libin Varghese

‎01-09-2018 11:23 AM - edited ‎01-09-2018 11:25 AM

 Hi Libin,

Thanks for the information.

I would like to know what happens, if "Cisco IronPort Spam Quarantine" feature key expires,

                 1. Does the End user or Administrator have the access to historical spam quarantine emails?

                 2. Does ESA needs "Spam Quarantine" feature key?

                 3. Is there any possibility to move Spam quarantined emails from SMA to ESA?

 

 

0 Helpful

dmccabej
Cisco Employee
Cisco Employee
In response to pbabu6001

‎01-09-2018 01:14 PM

Hello,

 

When a feature key expires for a service, then that specific service will no longer function. This would be the same for any ESA/SMA/WSA, but excluding any hardware perpetual keys that do not expire. 

 

As for migrating quarantined emails from an SMA to ESA, there is no official supported method; however, may be possible with a mix of releasing the quarantined emails on the SMA and making sure they are properly delivered to any ESA/s, and then making sure the ESA then tags them for quarantine. 

 

Thanks!

-Dennis M.

0 Helpful

dukebox
Level 1
Level 1
In response to dmccabej

‎10-12-2018 11:27 AM

I just experience this on my SMA, had a temporary license until my sale rep provide required licensing...I though that message tracking would simply stay local and be accessible locally until the SMA license is renewed....but base on what you are saying, my message tracking is loss ???  This is kind of drastic I feel, preventing from seeing it is one thing..but not logging it anywhere...is awful 

 

isn`t there any way to recover, resync ? If I disconnect the ESA from SMA will it have the message tracking somewhere to recover ?

 

That is a real issue if we forget license renewal...it should be better handle...we are still human

What happen if the SMA crashed? are we losing all centralize message tracking?

Prab
Level 1
Level 1
In response to dukebox

‎08-02-2019 12:24 AM

At the moment, there is no way to sync the data as per Cisco TAC. Usually if there is a network issue the ESA buffers the data and later sends it to the SMA, however in case of expired license, the SMA becomes bit ignorant. :D

 

I have requested them to create an EHN request:

That the ESA should buffer the data if the SMA is refusing to accept data because the License is expired.

The EHN could read be here: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvq66663

 

and also, please ask the TAC to link your tickets to this EHN, in case you faced this issue and created a ticket.

 

Thanks & regards,

Prab

0 Helpful

Mathew Huynh
Cisco Employee
Cisco Employee
In response to dukebox

‎08-05-2019 03:45 PM

Hey Duke,

I do see the predicament that would be - on the ESA (if the SMA license has expired or has crashed) the ESA will not auto-switch to local tracking, however all the files the ESA generates for the SMA message tracking to pull from will still be made.

The information is stored for up to 60 files (typically 3 hours). If there is no pulling of the data from an SMA then we'll purge older data to make room for newer.

Regards,
Mathew
0 Helpful
Customers Also Viewed These Support Documents