Policy quarantine questions

[mychrislo]

I'd like to perform lawful intercept on outgoing mails.

But the requirement is not using keyword, rather, it is based on sending user email addresses.

I can do the following, but I will need to update and keep in sync the dictionary.

MonitorUserFilter: if mail-from-dictionary-match("MonitorUserGroup", 1) {

                       duplicate-quarantine ("Logging");

                   }

This will let the copy of email go to the "Logging" quarantine pool.

Questions

1. Can I do LDAP (Windows AD) group match here? This will be much better than mantaining the dictionary.

2. The ESA has quarantine spool set to a few Gigabyte (say sometimes 8G sometimes 7G). versoin .7.5.2

How do I expand the quarantine spool size? It seems it has been asked a few times. Do I need to use

SMA (m-series) to have a bigger external quarantine?

3. Considering quarantine has a web interface for searching, it seems to be much better to use

duplicate-quarantine than "bcc" or "archive" filter action. BCC I need to have a email server to receive it, but

no searching capability. ARCHIVE, I need to regularly copy the archive files out and also lack of user interface to manuiplate.

Thanks.

Chris Lo

[Donald Nash]

Regarding #1, look for the mail-from-group rule.

I can't help you with #2.

Regarding #3, I'd prefer BCC myself because then I could use a full-featured email client for searching. But our environment is such that I'd have an easy place to send the BCC copies and wouldn't need to spin up a whole new server just for the purpose.

++Don

[donnylee]

Hi Chris

#1. Like Don mentioned, you can use mail-from-group rule.

#2. ESA quaratine space is not determined by AsyncOS version, but by hardware model. For the requirement of larger spam quarantine space, you could consider using an SMA. Also, in SMA you can customize the unused space into spam quarantine space.

#3. BCC and archive will work. If you archived into a Unix box, you could use all Unix commands for searching/manipulating.

Regards,

Donny

[mychrislo]

Hi Donny,

Many thanks for the suggestion, I want to ask how to use "mail-from-group"

I got

"

LDAP: Listener Outbound does not reference a valid group query, comparison in filter will evaluate as false

"

from the error_logs

I have a ldap group query defined (typical ad group query), how do I write the filter then?

Thanks.

Chris

[donnylee]

Hi Chris,

Did you try including the Base DN when specifying the LDAP group in your filter?

I guess your filter should look like:

MonitorUserFilter:

if (mail-from-group == "CN=Example Group,OU=Our Groups,DC=example,DC=com")

{

duplicate-quarantine ("Logging");

}

Regards,
Donny

[mychrislo]

Hi Donny

Thanks for the hint. This works. But also need to add the group query to the outbound listener.

I find two way to achieve the same result(?)

a)     Add the group query to the outbound listener. Then write a message filter (cli) as above.

b)     Use the GUI, add a policy to the outgoing mail policy PLUS a content filter. The matching policy is to use the ldap group query with "CN=Example Group,OU=Our Groups,DC=example,DC=com" as SENDER for the criteria to hit.

The content filter is simply unconditionally

     Condition (empty = always hit)

     Action=Quarantine     rule=duplicate-quarantine ("Logging")

I'm still try to quarantine this to my M-series though.

Is Policy Quarantine can be done as Spam Quarantine the same way to use external storage?

Best Regards,

Chris

[donnylee · Accepted solution]

Hi Chris,

Affirmative, the mail-from-group rule will only work if you enabled LDAP group query to the listener (my apologies, I thought you already had grroup query added to the listener config previously).

Unfortunately you cannot add any additional quarantine in the M-series, it is specifically made for Centralized/External Spam Quarantine. Unless you would "mark" these mails as spam, but I doubt you want to do it this way

-Donny

[mychrislo]

Hi Donny,

If M-series is not a complete answer to Policy Quarantine. Then I would actually raise a feature request (thru' proper channel) to see how to make it work here.

Perhaps I have been misunderstanding how this works....

Lawful intercept or Email archiving is one of the feature we believe is available since Ironport inception. That works. But we need a big Policy quarantine area to keep it. If M-series can't be used, C-series is also not big enough to hold the emails for sufficient long time.

We would then be needed to look at other solution such as "postini" exchange journaling.

Thanks alot

Chris

[Donald Nash]

Chris,

You can mark a message as spam via a message or content filter by adding a specific header to it. I don't remember the header, but I do know it was discussed here in this forum a few months ago (I started the thread by asking for a way to send a message to a spam quarantine programmatically). This would let you send the messages in question to the M-series quarantine. This isn't perfect because you are using the spam quarantine for policy reasons, but it may work out okay depending on what else you use the spam quarantine for.

++Don

[mychrislo]

Hi Don,

Indeed there are two ways to send to ISQ.

a)  alt-mailhost('the.euq.queue')

b)  Insert-Header ('X-Ironport-Quarantine: somevalue')

But both will send the mail to quarantine and stop, even if I have an action such as duplicate-quarantine. No mail is sent to recipient.

It may sound weird to most because why would we need to ISQ an email but at the same time want to mail be delivered.

My goal is to just copy it, and send it to ISQ, while let the mail be delivered.

At this moment, I can't get both done at the same message/content filter.

MonitorUserADGroupFilter: if mail-from-group == "CN=somegroup, OU=XX, DC=company, dc=com" {

                               deliver();

                               alt-mailhost ("the.euq.queue");

}

deliver() is now called "skip-filters()", btw.

The above wont work because once delivered, the message is no long exist and quarantine to 'the.euq.queue' do no effect.

If I put alt-mailhost higher than deliver, then the message does not deliver.

Also replaced with "duplicate-quarantine" to deliver(). Same behavior.

What's the best way to "deliver and copy to ISQ"?

Regards,

Chris

[Tom Foucha]

Why not send those messages to another mailbox in your email system for archiving and accountability. Think of it as an off-box policy quarantine.

Sent from Cisco Technical Support iPad App