Sender Groups & MailFlow policies - IP Segment based ?? or not .. on ESA

[rolelael]

Cisco ESA AsyncOS 11.1.0-128

Hello

Recently we bumped into an issue ..

We have a sender group called applicationservers, were we have IP segments in it  ( from internal datacenter segments ), example 10.64.0.0/24 etc ….

This sender group is assigned a mail flow policy ACCEPTED with limites set like max recip. / hour 10.000 and max connections 10 etc

We found that it looks like the counter is increased for the complete segment listed in the sender group and not on the IP from which an application server is sending

Example 2 servers : 

a) 10.64.10.10 sends 12000 recipients in 1 hour , gets rate limited at 10.000 = ok

b) 10.64.10.11 send 1200 recipients in the same hour ,gets also rate limited due to the segment limit

We never saw this issue..... and maybe we overlooked it when setting up our esa's….

Can someone confirm this behaviour ? Is this normal ? So counts on segment based an not individual ip's in the same segment

Tx

[Libin Varghese]

This would be the current design, yes.

This was changed based on requests around Async OS 8 since limits being applied to individual IP's was resulting in the ESA accepting a lot more emails than it should, so the limit is now applied to the complete subnet.

A defect was filed to confirm this and was assessed and confirmed to be how the current working would continue to be.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuv17771/?reffering_site=dumpcr

Regards,

Libin