Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Mike Kwilosz
08-18-2017
Stats
Member since
01-19-2011
28
Posts
11
Helpful
1
Solution
07-14-2015
10:17 AM
We have two S370(AsyncOS 7.7.0-761) running load balanced behind WCCP. We have a 6Mb/s satellite link to the Internet with 6000 users behind it. Caching is currently configured in Optimized Mode. My questions are as follows: 1. How do I determine if the Web Cache is benefiting us? 2. What kind of reporting is available for viewing the benefits? 3. How can I tell if I have it optimized for our environment?
... View more
Labels:
04-22-2014
02:03 PM
I'm getting ready to load balance some S370 WSAs via WCCP across a ASA 5520. Any issue with load balancing an uneven amount of WSAs? For instance any problem if I load balance across 3 S370s? Thanks, Mike
... View more
Labels:
03-27-2013
10:06 AM
Chris, I just verified. This did the trick for me. Thank you very much! Mike
... View more
03-27-2013
09:13 AM
Chris, Thank you for the code! I'm going to give it a try here in the next few minutes and I will let you know if it does the trick. Thanks, Mike
... View more
03-26-2013
02:00 PM
Due to auth issues with machine credentials caching on the WSAs and causing users to be unable to access the Internet I was wondering if I could allow a specific path and block the rest of the site to users. So I would like to specifically allow the following: http://liveupdate.symantecliveupdate.com/liveupdate_3.3.0.99_english_livetri.zip And blacklist this site: http://liveupdate.symantecliveupdate.com/ Is this possible? Regex? Thanks, Mike
... View more
Labels:
Created by
Mike Kwilosz
in Email Security
in Email Security
04-18-2012
03:32 PM
04-18-2012
03:32 PM
I know a lot of our users still experience this. We've been able to track it back to people trying to send to googlemail.com domains. Does anyone have any further info on this? Its really a nuisance.
... View more
Created by
Mike Kwilosz
in Email Security
in Email Security
04-13-2012
08:23 AM
04-13-2012
08:23 AM
I thought about going the more effective route myself but ran into issues where way too many legitimate senders do not have the same Mail From address as they do Envelope Sender address. We do use this method though for all of our internal domains. This way if anyone tries to spoof our domains from the outside they are unable too. Of course even in this case we've had to add some specific allows for certain vendors of ours who spoof us when sending into us but so far the message filter shown below has worked very well. Basically I reference a dictionary file which has all of our internal domains listed in it. Then I compare it to the HAT RELAYLIST which contains all of the approved sending addresses. Then I wrap it up with an ALLOWEDSPOOF and TLS_Required HAT groups with include exception IPs that are allowed to send as us. If the message doesnt meet this criteria it notifies me with an email and sends the message to a quarantine called Spoofed Domain Names for further analysis. So far its been working like a champ! AntiSpoofing: if (mail-from-dictionary-match("internal_domain_list", 1)) AND (sendergroup != "RELAYLIST") { if (sendergroup != "ALLOWEDSPOOF") AND (sendergroup != "TLS_Required") { notify (youremailaddress@here.com); quarantine("Spoofed Domain Names"); } }
... View more
04-13-2012
07:34 AM
Thanks Steve. I actually received the same response yesterday also. I'm fine with the change since we were definitely experiencing the lockup when someone tried to push an extremely large file through the DLP system. My concern now is what to do if someone needs to send a file larger but the DLP policy is trying to trigger and encrypt the message. I'm thinking of possibly creating a bypass message filter so if a certain keyword is found in the subject line the message immediately gets emailed without scanning for DLP. Of course this brings up the concern of people sending out items they shouldnt be and bypassing the DLP policy. I'm thinking I could CC our Management on any sensitive information that has been requested to be sent unencrypted to avoid it being taken advantage of.
... View more
Created by
Mike Kwilosz
in Email Security
in Email Security
04-12-2012
03:47 PM
04-12-2012
03:47 PM
We currently struggle with the same issue on a daily basis. The best way we've found to resolve this issue is create an Incoming Mail Policy which is based on these senders @fedex.com, @usps.com, and @ups.com and have an Incoming Content Filter attached to this Mail Policy which checks the condition of their SPF record and if the record comes back as any other than PASS the message gets sent to a quarantine for further analysis. So far this seems to have worked fairly well. Only a very small handful of messages ever hit the quarantine that are legitimate. Of course this all relies on the sender having their SPF record setup properly which in some cases (@cisco.com for instance) although they have an SPF record pretty much every place they send from is considered a spoof of their domain so almost all messages hit the quarantine. In these cases we've had to remove the sender domain from the incoming mail policy. If you hear of a better method or if someone wants to offer a better solution I'm game. Otherwise it feels like a constant cat and mouse game to me. Thanks, Mike
... View more
04-12-2012
03:31 PM
I actually have the same question and I'm looking for an answer also. I believe from the testing I've done that the current default PXE size is set to an encrypted size of 10MB. I believe this was put into place when version 7.6 of AsyncOS was rolled out. I also assume the reason this was put into place was because of a common issue we were experiencing where customers of our would try to send out extremely large emails that required encryption and it would effectively make our Ironport become unresponsive to the point that we would have to manually hard power cycle them. Also bringing up the question again of why don't our C370's have DRAC cards in them. I am yet to figure out if there is a way to adjust this size. I sent in a support case to ask for the same information. If I receive a reply back I'll update you. Thanks, Mike
... View more
04-09-2012
03:55 PM
I'm trying to do this exact thing and I'm running into some problems. I've created the following message filter but it doesn't appear to be working. Has anyone successfully got a message filter to work based on a dictionary file which the filter references and grabs the filename of the attachment and quarantines it? Thanks, Mike
... View more
09-01-2011
08:34 AM
You know thats another good way to approach it. I might actually try that since one of the issues I have having is a way to get the copy of the config from an attachment in my email to a folder out on our network. Using that save command and then an ftp tool would probably remediate this. Thanks, Mike
... View more
09-01-2011
07:44 AM
Well you can't actually get Kiwi to directly backup the config. Instead you have to make Kiwi act like a scheduled task and run a command on the Ironport to output the config in an .xml file. With Kiwi I've setup the Type as Device.CLI.Send commands and then I just run a command on the Ironport that looks like the following. mailconfig 1 Then when the Kiwi job runs I receive an email with an attachment that contains a the config in an .xml file. I hope this helps. Thanks, Mike
... View more
Created by
Mike Kwilosz
in Email Security
in Email Security
08-18-2011
01:56 PM
08-18-2011
01:56 PM
Christopher, Thank you for the reply. I checked our appliances and noticed that this was not applied to them. I've gone forward with implementing it. I hope this will resolve our issue. Thank you for your assistance. Mike
... View more
Created by
Mike Kwilosz
in Email Security
in Email Security
08-17-2011
07:47 AM
08-17-2011
07:47 AM
So I'm having an issue blocking a specific sender from emailing us. The mail is from mail.vresp.com and the envelope sender is always something to the affect of this bounces-60ebdf6df3-088951a90a@b.cts.vresp.com Now currently I have a content filter in place that I use for dropping unwanted inbound email. It works great for everyone I add to it but for some reason this one specific address refuses to get blocked. The way I have the content filter setup is it triggers on the condition "Envelope Sender" and it bases it on a Dictionary File that I add unwanted domain names too. So for instance if I wanted to block any email in the future from microsoft.com I would simply put @microsoft.com in the dictionary file and that would do it. Now for some reason this one specific domain @b.cts.vresp.com will not seem to get blocked. I have tried adding @b.cts.vresp.com @mail.vresp.com vresp.com and none seem to do the trick. So I'm reaching out for some help. Does anyone have any good suggestions as to how I might block this sender going forward? Below is the header information from a message sent from this sender. Let me know if I'm missing something. Thanks, Mike Received: from () by () with Microsoft SMTP Server id 8.2.254.0; Mon, 15 Aug 2011 11:35:50 -0700 Received-SPF: Pass (: domain of bounces-60ebdf6df3-088951a90a@b.cts.vresp.com designates 74.116.89.11 as permitted sender) identity=mailfrom; client-ip=74.116.89.11; receiver=ipesa01.pnshs.com; envelope-from=" bounces-60ebdf6df3-088951a90a@b.cts.vresp.com "; x-sender=" bounces-60ebdf6df3-088951a90a@b.cts.vresp.com "; x-conformance=spf_only; x-record-type="v=spf1" Received-SPF: None (: no sender authenticity information available from domain of postmaster@mkt2-sc.verticalresponse.com ) identity=helo; client-ip=74.116.89.11; receiver=; envelope-from=" bounces-60ebdf6df3-088951a90a@b.cts.vresp.com "; x-sender=" postmaster@mkt2-sc.verticalresponse.com "; x-conformance=spf_only X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AmUEAF1mSU5KdFkLjWdsb2JhbAA1CQOCSzWBQwOERY9vhw8BhyFqFAEBAQEJCQsJEgUigUoaBgoTAwECAwUDAgwICAsBBQcfCAIcAQkCAhsWDwknGwIEh1OoDIMbgUWEaQEEAoEqgXQggXeBEIJVkEGFDItr X-IronPort-AV: E=Sophos;i="4.67,374,1309762800"; d="scan'208,217";a="2041549" Received: from mkt2-sc.verticalresponse.com ([74.116.89.11]) by with ESMTP; 15 Aug 2011 11:34:15 -0700 Return-Path: < bounces-60ebdf6df3-088951a90a@b.cts.vresp.com > DomainKey-Signature: q=dns; a=rsa-sha1; c=nofws; s=mkt; d=vresp.com; h=DKIM-Signature:Received:From:Reply-To:To:Subject:Date:Message-ID:List-Unsubscribe:MIME-Version:X-Company_ID:X-vrfbldomain:X-vrpod:X-CTS-Enabled:X-Campaign:Content-Type; b=KRtxoK8e7VkhqtjPWdDgZo16eXUASjyTPq4RMEPcSPZc9386gKM9Y205C/on2iLK S0ZlQypXY/OZgZWGsDkAYbt+9AYfkYPg9blmB5CVLZcaPhaMCDUejHgb7MWqOlXd 4haUmfxTEnEE7BOJcQBZ3SzSZj3YWnIeieiOpyVI3/k= DKIM-Signature: v=1; a=rsa-sha1; d=vresp.com; s=dkim; c=simple/simple; q=dns/txt; i=@vresp.com ; t=1313433348; h=From:Subject:Date:To:MIME-Version:Content-Type; bh=uuDNwk+PHTDmCjp1/xovAioRhWU=; b=mQygs7zs3/Xe+eFNSTo79QZaqp2WviP5DcDJURuEYTwcd9w5YHQ+TGGlSdAgYiCG ir6UygHChQcMSjQ8f4y06k260a8q8b8ZtJimN2o7zKBjd+pgFtE8Eyhcid5uBYLW LmCfrlb0exei33+yiHJhxiVh/XTS5J0cPSyZf/suJ1o=; Received: from [10.4.7.80] ([10.4.7.80:58830] helo=mailer03.sf.verticalresponse.com) by demosthenes (envelope-from < bounces-60ebdf6df3-088951a90a@b.cts.vresp.com >) (ecelerity 3.0.28.38595 r(38597)) with ESMTP id C7/E1-25910-407694E4; Mon, 15 Aug 2011 11:35:48 -0700 From: Tango Networks < Tango_Networks@mail.vresp.com > Reply-To: "Tango Networks" < reply-60ebdf6df3-088951a90a-631e@u.cts.vresp.com > To: < > Subject: Unique Solutions, Great Reseller Program, Let's Tango. Date: Mon, 15 Aug 2011 18:35:48 +0000 Message-ID: < 60ebdf6df3-@mail.vresp.com > List-Unsubscribe: < mailto:reply-60ebdf6df3-088951a90a-631e@u.cts.vresp.com?subject=unsubscribe > MIME-Version: 1.0 X-Company_ID: 647838 X-vrfbldomain: fbl.p0.verticalresponse.com X-vrpod: p0 X-CTS-Enabled: 60ebdf6df3-088951a90a X-Campaign: 60ebdf6df3 Content-Type: multipart/alternative; boundary="__________MIMEboundary__________"; charset="UTF-8"
... View more
Labels:
07-14-2015
We have two S370(AsyncOS 7.7.0-761) running load balanced behind WCCP.
We have a 6Mb/s satellite lin...
04-22-2014
I'm getting ready to load balance some S370 WSAs via WCCP across a ASA
5520. Any issue with load bal...
03-27-2013
Chris,Thank you for the code! I'm going to give it a try here in the
next few minutes and I will let...
03-26-2013
Due to auth issues with machine credentials caching on the WSAs and
causing users to be unable to ac...
Created by
Mike Kwilosz
in Email Security
04-18-2012
04-18-2012
I know a lot of our users still experience this. We've been able to
track it back to people trying t...
Created by
Mike Kwilosz
in Email Security
04-13-2012
04-13-2012
I thought about going the more effective route myself but ran into
issues where way too many legitim...
04-13-2012
Thanks Steve. I actually received the same response yesterday also. I'm
fine with the change since w...
Created by
Mike Kwilosz
in Email Security
04-12-2012
04-12-2012
We currently struggle with the same issue on a daily basis. The best way
we've found to resolve this...
04-12-2012
I actually have the same question and I'm looking for an answer also.I
believe from the testing I've...
04-09-2012
I'm trying to do this exact thing and I'm running into some problems.
I've created the following mes...
09-01-2011
You know thats another good way to approach it. I might actually try
that since one of the issues I ...
09-01-2011
Well you can't actually get Kiwi to directly backup the config. Instead
you have to make Kiwi act li...
08-18-2011
Christopher,Thank you for the reply. I checked our appliances and
noticed that this was not applied ...
Public Statistics
| Date Registered | 01-19-2011 07:37 AM |
| Date Last Visited | 08-18-2017 03:56 AM |
| Total Messages Posted | 28 |
| Total Helpful Votes Received | 11 |
