Requirement Email attachment configuration in Cisco Ironport C170

[arjunpn]

Dear All, 

We have a requirement from one of the customer that they are asking to configure filters based on below condition

1.Internal user sending to Public Domain (Gmail, Yahoo,rediff..etc) without attachment

2. Internal user sending to Public Domain (Gmail, Yahoo,rediff..etc) with attachment

3.Internal user receveing from Public Domain (Gmail, Yahoo,rediff..etc) without attachment

4. Internal user receving from Public Domain (Gmail, Yahoo,rediff..etc) with attachment

I am unable to put nested if condition in the content filter. eg. if the user under condition 3(refer above) get an email with attachment it should quarantine. 

Also, if the email is sent to multiple users (who are under condition 3 and 4) then emails should deliver for the user under condition 4 and email should get quarantined for the user under condition 3.

your assistance is appreciated.

[Rehan Latif]

Hi Arjun,

Best scalable solution is to use LDAP groups in the Incoming/Outgoing mail policies.

You can first configure an LDAP profile, with LDAP group query, then enable that query on listeners.

After that create Mail policies with members as recipients/senders from LDAP group.

By using Mail Policies, system will splinter (split) the messages if there are other recipients not member of that group.

Content Filters does not give an option to configure nested conditions. This can only be done using Message Filters from CLI -> filters command. However, Message filters work on whole message and are not per recipients.

I would recommend going through the Admin guide/online help to get all the details and differences between message filters and content filters.

Hope this will help.

Rehan