cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Cisco Secure Email Support Community

Product Support Talos Support Cisco Support Reference + Current Release
Gateway Reputation Lookup Open a support case Secure Email Guided Setup
Gateway: 14.0.2-020
Cloud Gateway Email Status Portal Support & Downloads docs.ces.cisco.com
Email and Web Manager: 14.1.0-239
Email and Web Manager Web & Email Reputation Worldwide Contacts Product Naming Quick Reference
Reporting Plug-in: 1.1.0.136
Encryption Bug Search
Encryption Plug-in: 1.2.1.167
Cloud Mailbox Notification Service
Outlook Add-in(s): More info

594
Views
0
Helpful
1
Replies
Tomki
Beginner

is there any downside to setting the reporting multiplier to 1?

disclosure: I don't think so; the default inflation of 3 may or may not be valid, but it doesn't actually represent what happens on the system.  Maybe it's good for internal marketing?  So I see this post is more of a recommendation than a question.

 

Since the value is set to 3 by default; this means that for most environments the Overview page's Incoming Mail graph has other categories crushed under blue bars for "IP reputation" - incorrectly: the multiplier reporting to inflate every rejected connection by that value.  The implication of this is more than just a boasting of rejections, but also minimizes how much actual traffic is dealt with in other categories.

 

The value is set via the CLI only: reportingconfig -> mailsetup -> multiplier

 

There is no implication to actual traffic or other logic on the system, with either the default of 3 or my preferred 1.

 

 

1 REPLY 1
Libin Varghese
Cisco Employee

There should be no downsides, however the default value of 3 is for the below reason.

 

Since we don't know number of messages that can be received on the connection that is rejected, a default multiplier of 3 is considered for every rejected mail. You may receive 1 email on a connection or 100 (depending on what's configured in the mail flow policies), so the reported numbers may be high or low depending on the way you look at it.

 

The rejection based on reputation happens before any additional email details (sender/recipient/email content) are received from them, this also helps reduce a lot of overhead on the device.

 

Regards,

Libin

Create
Recognize Your Peers
Content for Community-Ad