You are correct, when there is no attachment in the original email then the message is decrypted using the JavaScript logic contained in the envelope HTML.  If for some reason the JavaScript cannot be executed, for example if the browser setting does not allow it, or the recipient's gateway has removed or "defanged" the JavaScript, then online opening is used.  With online opening the encrypted message contents are posted back to the key server (res.cisco.com) and the server decrypts the message.  There are other scenarios but these are the main ones.  In summary the Java applet is loaded if the original email contains an attachment and online opening is not selected.  Hope this helps. ... View more

My Portuguese is not that good but I think you are asking how to configure NIC pairing? This is explained in the ESA user guide in a chapter called Advanced Network Configuration In the version 8 manual it is chapter 33. Basically it uses CLI command etherconfig ... View more

I think the answer is yes but it depends.  If the mail hosting includes the Internet mail gateway (your MX records point to the hosting company) then there's not much you can do about inbound protection.  If it is just hosting groupware and your MX records can point to your inhouse IronPort then you can do all the normal inbound protection (anti-spam, anti-virus, content checking, etc) and then pass it to the hosted groupware using SMTP as normal.  You would want to use TLS as you are likely going over the Internet to the hosting company.  Similarly for outbound protection, TLS from the hosted groupware to your inhouse IronPort which can do the normal anti-virus, content checking, encryption, etc.  You would have to factor in the extra bandwidth as all your mail will be flowing to and from the hosted environment.  Basically it is just lke any other installation with IronPort talking to groupware e.g. Exchange over SMTP but in your case that connection would be remote not local so you need to take appropriate steps (such as TLS) to protect the traffic.  But as I said at the start it depends on the hosted environment, what is being hosted and how much control you have over the configuration. Hope this helps. ... View more

Hi Jason, Please see another very recent thread on Permissions on PostX Jar for CRES https://supportforums.cisco.com/message/4096929#4096929 Basically the Cisco java applet needs to be updated to work with latest Oracle JRE update Kind regards, Dave ... View more

Hi John, I am getting the same kind of NPE error.  Snippet from Java trace: java.lang.NullPointerException at com.postx.client.Tools.genBaseDir(Tools.java:2075) at com.postx.client.Tools.run(Tools.java:394) at com.postx.client.EnvelopeTools.init(EnvelopeTools.java:73) at com.sun.deploy.uitoolkit.impl.awt.AWTAppletAdapter.init(Unknown Source) at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source) at java.lang.Thread.run(Unknown Source) preloader: Delivering: ErrorEvent[url= http://applet.postx.com/dist/ label=null cause=null basic: Removed progress listener: sun.plugin.util.ProgressMonitorAdapter@14f2dae preloader: Preloader shutdown after ErrorEvent preloader: Stop progressCheck thread ui: Show default error panel security: Reset deny session certificate store This is using Windows 8.1, IE 11, Java 1.7.0_045 This is not an officially supported environment, see http://www.cisco.com/en/US/docs/security/iea/Compatibility_Matrix/IEA_Compatibility_Matrix.pdf I also tried with Firefox 25.0.1 same result, the only difference is with IE it reverts automatically to online opener when the Java applet fails. I will try with Windows 7 (supported environment) I suggest you open a case with Cisco. ... View more

So just to confirm, the secondaryconfig command, which used to allow you to copy log files to two different SMAs, has been deprecated?  The command still exists and there are KB articles referring to it, but there is no help and no mention in the latest manuals.  Thanks. ... View more

The first prompt is to download the Java applet that is used to decrypt messages that contain attachments, assuming you are trying to open the envelope locally.  I assume you said "run" to that message.  The Java applet needs a supported Java Virtual Machine (JVM) to run in in the browser you are using to open the envelope.  The second message is implying that you don't have a JVM or not one that is enabled.  Is Java enabled in your browser?  Do you notice in your Windows notification bar if Java has been invoked?  Can you turn on Java console (Windows control panel) to see if Java is being invoked and not encountering an error? Next question is how you are opening the envelope.  Are you opening the html attachment in a browser?  (Which browser?)  Can you try clicking on the open online link at the bottom right hand corner of the envelope.  This avoids using the Java applet altogether and is a useful workaround.  If you can open the message that way it will help us pin down the error you are getting. Finally you mention a CRES toolkit.   Are you referring to the Java applet or a previous version of that?  The fact you are being prompted to download something suggests you are getting the latest version. ... View more

The sshconfig command should list the keys already there, or allow you to add new ones.  You can create new keys on the linux box using ssh-keygen command and then paste the key into the sshconfig command.  The help and manuals on this are a bit sparse, the best info I have found is in a Cisco publication written by a former Cisco IronPort employee Chis Porter, called "Email Security with Cisco IronPort" from ciscopress.com http://www.ciscopress.com/store/email-security-with-cisco-ironport-9781587142925 There's a whole chapter on automating with scripts like this. ... View more

Are you using a unix / linux host to run the script?  There is a tool called expect which works by issuing commands over e.g. an SSH interface with send and looking for a response with expect. http://en.wikipedia.org/wiki/Expect So you could issue the clusterconfig command and look for the prompt to validate the key fingerprint and send a CR (\n) I think there is a Windows based version as well, but I believe you have to run cygwin. There may be other ways.  I assume you have run sshconfig already to avoid having to use passwords?  That should have already validated the key. ... View more

If you want to simplify the opening of multiple CRES messages then there are a couple of options: 1 - If they have Outlook then the Outlook plug-in is one solution.  One issue here is although it is "free" you need a Cisco id with an associated service contract to be able to download the plug-in.   Also as you have noted you need to be configured for encryption to reply within Outlook, but you can still use the secure reply option if you open the CRES envelope "normally" (in a browser).  2 - If you send them envelopes with medium security then the recipient can "remember" their password in a secure cookie so they entry their password once and then for subsequent envelopes they just click open button.  No plug-in is required and any email client can be used.  You can set medium security / sensitivity in the encryption profile or in an x-header. 3 - If you send them envelopes with low security (sometimes called "no-authentication") then no password is required and the envelope just opens by clicking the acknowledge button (which replaces the open button).  The downside of this is that there is no authentication so the message is encrypted but anyone can open it.  Depends on your security requirements as to whether this is acceptable. In my opinion option 2 would be the best and certainly easiest to implement. ... View more

If you mean is the IP address that made the decryption key request accessible to you in a report or online query, then no. If you mean does Cisco have that information, then I guess it could have; CRES is a web server accepting HTTPS requests so there must be a source IP address for each request.  Whether they hold that information I don't know.  Whether they would let you have it if they did is very doubtful for privacy of the recipient reasons. ... View more

The SMA gets log files from the ESAs via SCP as you say.  I am not aware of any ability to copy log files onto the SMA (import data).  It may be possible to copy the old logs files back on to the ESAs, and then maybe the (new) SMA would find them and import them, but I don't know.  Maybe Cisco could comment.  What I meant when I said you could copy the source files is that you could interrogate them outside of the ESA/SMA environment using grep or maybe a tool like splunk if you needed to.  ... View more