This is probably being done by Outbreak Filter (used to be called Virus Outbreak Filter or VOF.  The rules to determine whether a message is suspicious are determined by Cisco, but you can decide in mail policies or filters what to do about it.  One of the actions is to rewrite any URLs contained in a suspiscious message, nother would be to prepend the subject.  Have a look at chapter 14 of the user guide (outbreak filters). ... View more

Correct, the number of appliances (physical or virtual) does not matter, you license users not appliances. ... View more

Did they get the same error before you sent them the new config, i.e. when they were using the plugin in decrypt-only mode?  If so that would indicate something fishy with the new config. If yes or they didn't use it before can you provide a redacted log?  See the admin guide to see where the logs are held. BTW thet admin guide has a troubleshooting section which says that error message "occurs if Outlook is online but your Internet connection has been lost or the server has become temporarily unavailable". ... View more

Hi Mike, You might find this KB entry #1765 answers your question. https://ironport.custhelp.com/app/answers/detail/a_id/1765 Basically you have to go into machine mode for each appliance but ensure you use the same certificate profile name. ... View more

You can use outgoing content filters to detect whether a message has been S/MIME signed. For example there will be a MIME header application/pkcs7-signature or there will be an attachment called smime.p7s If these tests fail (i.e. the message does not contain this MIME header or attachment) then you can safely add your disclaimer. ... View more

I'm not sure I understand the problem fully.  Do you mean DKIM signing?  That takes place right at the end of the outgoing mail pipeline, well after disclaimers have been added.   Or are you using some S/MIME signing process external to the ESA and you don't want to add a disclaimer otherwise you will invalidate the signature? ... View more

Not exactly what you are looking for, but another approach would be not to add the disclaimer to messages that already contain it, replies and forwarded emails for example.  You could do this by looking for a string in your disclaimer in the body text and only adding the disclaimer if that text is not there.  There was another question about this late last year which has more details. ... View more

I don't think you will find this information in a public forum.  The throughput is affected by many factors including AV and AS settings, use of TLS and encryption, DKIM signing, use of content filters, size of emails, etc.  You will find guidance on how many users a model of the ESA can support, based on general assumptions.  You may find some "unburdened" numbers which tell you how many emails an ESA could process if all it did was relay the mail, but that is not real world.  I think you will need to speak to your Cisco rep or SE if you want a number of emails based on your particular setup. ... View more

Thanks Brian.  What about the Firefox error noted above?  netscape.javascript.JSException: baseURI and docbase host DO NOT match: res.cisco.com BTW I have cleared the Java cache as per other post. ... View more

I see that a new version of the Java applet (now build 61 was 57) is available but at least from my limited testing it does not seem to have fixed the problem.  I have tried with Win 7 64 bit and Win 8.1 with IE 11 and Firefox 25. With IE 11 the envelope opens but you get this: Seems like it ws not decrypted or some other decoding error.  There is nothing in the Java log to suggest a problem (snippet) except it says at some point inIE: false when it should say true presumably. 2013-12-09 08:33:17.109: Ident: $Id: EnvelopeTools.java,v 1.21 2013/10/28 00:19:45 blm Exp $ 2013-12-09 08:33:17.109: build: 61 2013-12-09 08:33:17.109: build time: Sun Nov 10 23:08:03 GMT 2013 2013-12-09 08:33:17.156: Raw document.url: file:///F:/Users/Dave/Desktop/securedoc_20131119T002214.html 2013-12-09 08:33:17.172: documentBase not set, using documentURL 2013-12-09 08:33:17.172: documentBase: file:/F:/Users/Dave/Desktop/securedoc_20131119T002214.html 2013-12-09 08:33:17.172: documentURL: file:///F:/Users/Dave/Desktop/securedoc_20131119T002214.html 2013-12-09 08:33:17.172: documentCharset: utf-8 2013-12-09 08:33:17.172: codeBase: http://applet.postx.com/dist/ 2013-12-09 08:33:17.172: appletName: EnvelopeTools51 2013-12-09 08:33:17.172: Ident: $Id: Tools.java,v 1.9 2013/11/10 22:58:12 blm Exp $ 2013-12-09 08:33:17.172: Java: Oracle Corporation 1.7.0_45 2013-12-09 08:33:17.172: OS: Windows 8 6.2 2013-12-09 08:33:17.172: userAgent: mozilla/5.0 (windows nt 6.3; wow64; trident/7.0; .net4.0e; .net4.0c; .net clr 3.5.30729; .net clr 2.0.50727; .net clr 3.0.30729; rv:11.0) like gecko 2013-12-09 08:33:17.172: inIE: false 2013-12-09 08:33:17.172: OSMacOSX: false 2013-12-09 08:33:17.172: OSVista: true 2013-12-09 08:33:17.172: Free memory: 9103960 2013-12-09 08:33:17.172: Total memory: 16252928 2013-12-09 08:33:18.140: Envelope open took 0.781s netscape.javascript.JSException: baseURI and docbase host DO NOT match: res.cisco.com at sun.plugin2.main.client.MessagePassingJSObject.newJSException(Unknown Source) at sun.plugin2.main.client.MessagePassingJSObject.waitForReply(Unknown Source) at sun.plugin2.main.client.MessagePassingJSObject.eval(Unknown Source) at com.postx.client.Tools.callJavaScript(Tools.java:690) at com.postx.client.Tools.updateProgress(Tools.java:804) at com.postx.client.Tools.processPayload(Tools.java:958) at com.postx.client.Tools.run(Tools.java:459) at com.postx.client.EnvelopeTools.init(EnvelopeTools.java:73) at com.sun.deploy.uitoolkit.impl.awt.AWTAppletAdapter.init(Unknown Source) at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source) at java.lang.Thread.run(Unknown Source) preloader: Delivering: ErrorEvent[url= http://applet.postx.com/dist/ label=baseURI and docbase host DO NOT match: res.cisco.com  cause=baseURI and docbase host DO NOT match: res.cisco.com basic: Removed progress listener: sun.plugin.util.ProgressMonitorAdapter@d1cf9e preloader: Preloader shutdown after ErrorEvent preloader: Stop progressCheck thread ui: Show default error panel 2013-12-09 08:33:17.109: Ident: $Id: EnvelopeTools.java,v 1.21 2013/10/28 00:19:45 blm Exp $ 2013-12-09 08:33:17.109: build: 61 2013-12-09 08:33:17.109: build time: Sun Nov 10 23:08:03 GMT 2013 2013-12-09 08:33:17.156: Raw document.url: file:///F:/Users/Dave/Desktop/securedoc_20131119T002214.html 2013-12-09 08:33:17.172: documentBase not set, using documentURL 2013-12-09 08:33:17.172: documentBase: file:/F:/Users/Dave/Desktop/securedoc_20131119T002214.html 2013-12-09 08:33:17.172: documentURL: file:///F:/Users/Dave/Desktop/securedoc_20131119T002214.html 2013-12-09 08:33:17.172: documentCharset: utf-8 2013-12-09 08:33:17.172: codeBase: http://applet.postx.com/dist/ 2013-12-09 08:33:17.172: appletName: EnvelopeTools51 2013-12-09 08:33:17.172: Ident: $Id: Tools.java,v 1.9 2013/11/10 22:58:12 blm Exp $ 2013-12-09 08:33:17.172: Java: Oracle Corporation 1.7.0_45 2013-12-09 08:33:17.172: OS: Windows 8 6.2 2013-12-09 08:33:17.172: userAgent: mozilla/5.0 (windows nt 6.3; wow64; trident/7.0; .net4.0e; .net4.0c; .net clr 3.5.30729; .net clr 2.0.50727; .net clr 3.0.30729; rv:11.0) like gecko 2013-12-09 08:33:17.172: inIE: false 2013-12-09 08:33:17.172: OSMacOSX: false 2013-12-09 08:33:17.172: OSVista: true 2013-12-09 08:33:17.172: Free memory: 9103960 2013-12-09 08:33:17.172: Total memory: 16252928 2013-12-09 08:33:18.140: Envelope open took 0.781s If you use online opener it opens correctly like this. With Firefox the applet stops with a Java error: netscape.javascript.JSException: baseURI and docbase host DO NOT match: res.cisco.com at sun.plugin2.main.client.MessagePassingJSObject.newJSException(Unknown Source) at sun.plugin2.main.client.MessagePassingJSObject.waitForReply(Unknown Source) at sun.plugin2.main.client.MessagePassingJSObject.eval(Unknown Source) at com.postx.client.Tools.callJavaScript(Tools.java:690) at com.postx.client.Tools.updateProgress(Tools.java:804) at com.postx.client.Tools.processPayload(Tools.java:958) at com.postx.client.Tools.run(Tools.java:459) at com.postx.client.EnvelopeTools.init(EnvelopeTools.java:73) at com.sun.deploy.uitoolkit.impl.awt.AWTAppletAdapter.init(Unknown Source) at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source) at java.lang.Thread.run(Unknown Source) preloader: Delivering: ErrorEvent[url= http://applet.postx.com/dist/ label=baseURI and docbase host DO NOT match: res.cisco.com  cause=baseURI and docbase host DO NOT match: res.cisco.com basic: Removed progress listener: sun.plugin.util.ProgressMonitorAdapter@d1cf9e preloader: Preloader shutdown after ErrorEvent preloader: Stop progressCheck thread ui: Show default error panel ... View more

There's a KB article #1271 on replacing a disk "Replacing drives on IronPort appliances": https://ironport.custhelp.com/app/answers/detail/a_id/1271 ... View more