Hi Jeff, I think you should post this question in WSA / FWNG forum. ISE doesn't do traffic limiting. WSA can do it, ASA/FTD can do it. ... View more

Have you imported the exported certificate (.p12) file into Personal container in Firefox? ... View more

Do you have openssl installed on client machine? You can extract cert to human readable format by running: openssl pkcs12 -in esa.domain.tld.p12 -clcerts -nokeys -out esa.domain.tld.crt openssl x509 -in esa.domain.tld.crt -text Firefox supports importing .p12 file natively - you can try to import it to Firefox for testing purposes. ... View more

Hi, ESA generates .p12 file type - this is the PKCS#12 format. It's a binary format that includes certificate, private key and intermediate certificates optionally. ... View more

Hi Erfan, I'd suggest you to open a TAC case to have a look at your issue when email's language is not correctly classified as Chinese language. I think there's not much more you can do. Please keep us updated on this issue. ... View more

Hi Erfan, you typically can place WSA in core/DMZ but it's not really mandatory. It depends on topology (transparent/explicit, single interface/separate data&management etc.) But since you're using ASA to do transparent redirection you need to have WSA data interface located in client subnet. You can find the requirement via link I posted already, Cisco Live presentation (https://www.ciscolive.com/online/connect/sessionDetail.ww?SESSION_ID=76612&tclass=popup) etc. How can you solve the problem: use explicit forward proxy mode and deploy settings via DNS/DHCP/GPO/manually... use L3 switch like catalyst 3k/6k for transparent redirection ... View more

Hi Erfan, create dictionary that contains all "bad words" you'd like to match for body, subject & sender (1st screenshot). Then create content filter similar to this one: Order Condition Rule 1 Envelope Sender mail-from-dictionary-match("BadWords", 1) 2 Subject Header subject-dictionary-match("BadWords", 1) 3 Message Body body-dictionary-match("BadWords", 1) 4 Message Language message-language == "zh-cn,zh-tw" Items 1-3 are used for matching Sender, Header and Body to text defined in dictionary you created in first step. Item 4 is only available in AsyncOS 10: ESA can determine email language for 11 different languages. Choose action for matching email messages (quarantine, drop....). Last step would be binding new content filter with mail policy. ... View more

The only topology that the adaptive security appliance supports is when client and cache engine are behind the same interface of the adaptive security appliance and the cache engine can directly communicate with the client without going through the adaptive security appliance. More info: https://supportforums.cisco.com/document/48341/asa-wccp-step-step-configuration ... View more

No, you can manage message filters only through CLI. Only content filters are managed through GUI. ... View more

Hi, log in via ssh to ESA. CLI -> filters -> detail -> Quarantine_Spoofed_Email ... View more

Hi Imtiaz, the point is to detect & prevent emails that contain your domain name in sender address (From) and at the same time such emails haven't been sent from trusted network/hosts (outgoing mails). So IP address must be different than IP addresses of allowed relay hosts - hosts that are permitted to send outgoing emails through ESA. So when creating content filter replace 1.2.3.4 with IP addresses of your approved relay hosts. And replace domain name mydomain.com with domain name you're using. You can create custom action for emails matching these criteria: drop email, quarantine email, notify email administrator/you etc. Whatever it fits you best. If you don't use ESA to relay outgoing emails then it's even simpler to create content filter: just detect email containing your domain name in From (sender) and block those messages. If you're using some service outside of your network to generate and send emails on behalf of your domain (marketing messages for example) you should create exception similar to relay hosts. ... View more

Hi Imtiaz, please find the following document that'll walk you through DKIM/SPF implementation: www.cisco.com/c/dam/en/us/products/collateral/security/esa-spf-dkim-dmarc.pdf Because enabling SPF/DKIM verification globally it can impact other (legitimate) emails also. Maybe you should implement it for your domain only by adding another condition: "mail from" ends with "your-domain.com". Forged email detection Dennis mentioned is great feature introduced in AsyncOS 10. It's focused more on detecting cousin domains and forged email senders by using your company person's names together with some XY domain name. This feature can detect forget emails that pass DKIM/SPF validation. Great complementary feature. Regarding message filters Dennis and I already mentioned. You can achieve similar result by using content filters. Please look at attached screenshot how to do it. Don't forget to activate this filter in incoming email policy. ... View more

Hi Imtiaz, as I understand you're getting email messages with spoofed email sender - sender's email address forged as it'd be one of your own email address. You can do the following: - block emails containing @yourdomain.com as sender's email address on public listener (if you have public & private listener) or create message filter that'll block such messages when smtp host is not one from relay hosts defined for outgoing messages - implement SPF/DKIM and block/quarantine messages that fails validation ... View more

Hi, if you don't have LDAP you can still use SMTP call-ahead. Be aware that invalid recipient counts for maximum number of invalid recipients for DHAP attack prevention. ... View more