Hi, if you have the message tracking set to local "once you removed the SMA" and the message tracking are located on the ESA appliances. You are able to view the message tracking for the ESA side, and after enabling The centralized email tracking you will have availability from the time it was enabled Regards, Raed ... View more

Hi, mail_logs already logs the sender IP address and sender/recipients email-addresses. Snippet from the mail_logs "for a test e-mail that i send in our local labs" i used BOLD for the sender IP/sender/recipient.  Thu May 26 12:24:06 2016 Info: New SMTP ICID 2006 interface management (10.48.78.10) address 10.48.78.35 reverse dns host _ldap._tcp.dc_msdcs.ironport.local verified no Thu May 26 12:24:06 2016 Info: ICID 2006 ACCEPT SG WHITELIST match 10.48.78.35 SBRS rfc1918 Thu May 26 12:24:06 2016 Info: Start MID 2781 ICID 2006 Thu May 26 12:24:06 2016 Info: MID 2781 ICID 2006 From: <raed@munich.local> Thu May 26 12:24:06 2016 Info: Alias match: MID 2781 RID 0 recipient raed@amman.local mapped to ['mahmoud@amman.local'] Thu May 26 12:24:06 2016 Info: MID 2781 ICID 2006 RID 0 To: <mahmoud@amman.local> Check the following How do I search and view the mail logs on the ESA Regards Raed ... View more

Hi OSung, To lead a license file do the following, CLI > loadlicense > paste via CLI "just copy pate the provide license file" or you can choice the second option load from file and put the file path. In case you are talking about feature keys "they will be a string of number/characters" then just do the following, CLI > featurekey > activate > "just paste the string" Regards, Raed ... View more

Possible, As i know the status is based on the history > up-to-date behavior of the site. This is why i suggested to open a TAC/Support if possible so that the WBRS team would review the site and see if an enhance to it's score is possible or not.    From Senderbase "just go to web >  My website's reputation is poor"  Regards, Raed ... View more

Hi, I would suggest opening a TAC "support" ticket so that the WBRS team can review the URL in question to see if an enhance for the score is possible or not. Also "In case you opening a ticket isn't an option" another option would be to WHITELIST the URL in question check the following How do I manually whitelist a webpage on the Cisco Web Security Appliance (running 5.2.0 and above) so that WBRS, WebRoot or McAfee scanning is bypassed? ... View more

Hi! please check the following: Cisco Web Security Appliance Data Sheet Regards, Raed ... View more

Hi Michael, Having an SMA in your network would be the solution since you would have a centralized Spam quarantine and you would have a safelist/blacklist option for the centralized quarantine of all appliances hence  synchronization between different appliances will be achieved since you will have a signal centralized  quarantine. If you don't have an SMA in your network then you will be using local quarantine on each appliance, hence each will be separated. Also it is also suggested to have backup of your safelist/blacklist. check the following article regarding ESA Safelists/Blocklists Backup Procedure Regards, Raed ... View more

Hi Michael you are correct if you are using local quarantine then you can't back it up/move it since it is localized, this is one of the advantages of having a centralized  Quarantine using a SMA. ... View more

Hey! You need to open a TAC case to do the password reset, just open a case with the title Password reset and include the full SN of your appliance in the case notes. Regards, Raed ... View more

End User Quarantine option in the Spam quarantine is used to enable the access to the spam quarntine for end users "non administrative users". This option has 3 variants: 1. NONE: End users will only be allowed to access the IronPort Spam Quarantine via the links included in notification messages, but they will not be authenticated (does not require a username and password). 2. Mailbox (IMAP/POP): For sites without an LDAP directory to use for authentication, the quarantine can validate user email addresses and passwords against a standards-based IMAP or POP server that holds their mailbox. 3. LDAP server You need to have LDAP server set-up on the appliance "System administration > LDAP". Spam Notifications for End Users enabling Spam Notification causes email notifications to be sent in digest format. From there once you enabled the option you can control the following: 1. The e-mail address that the spam notification will be send by. 2. Who will receive these spam notification ( All users, or you can select specific users from the LDAP groups "again you need to have LDAP enabled on the appliance"). 3. You can select how the spam notification will look (from subject, title, what langue the spam notification will be send with, the format of the message "HTML/Text/Combo" and the body of the message it self ). 4. Consolidate Notifications "this option is for LDAP only" 5. Set the schedule of when these notifications will be send (daily/weekly/monthly ), in the daily option you can select single or multiple days and the time of the day also. Hope this made things more clear, as always if you need any further information you can check with the user guide http://www.cisco.com/c/en/us/support/security/email-security-appliance/products-user-guide-list.html Regards, Raed ... View more