About David Miller

David Miller · ‎12-16-2015

How about some logic like: if email has no image attachments - skip remaining filters if email has an attachment file name not in regex image0*.gif - drop

David Miller · ‎12-16-2015

Could you use a regex to specify the file name (Attachment File Info) like image0*.gif? That would allow for multiple files. Or you could create a Content Dictionary with all the allowed attachment file names.

David Miller · ‎10-30-2015

Hi Mathew, were you able to find out any more on this defect? Now 28 support cases. Thanks, Dave

David Miller · ‎10-20-2015

I saw a datasheet on this product with an anticipated release date of October 2015. It includes the ability to encrypt using PXE. My question is, does this / will this use the CRES PXE key store or is there a local PXE key store option? Thanks, Dave

David Miller · ‎10-20-2015

Hi Jason, Rather late response but I only just saw this. Your analysis is correct, and I think your workaround (encrypting incoming replies) is the only option. Whether that is worth doing depends on why the 3500 users want the replies encrypting to their desktop. Is there some regulatory reason? Do the senders want to authenticate? Do they not trust the internal network? You will need to find the business reason behind this or convince them that is is secure enough with TLS to your gateway. Hope this helps, Dave

David Miller · ‎10-04-2015

There is a bug CSCuu20917 which was last updated 23 September 2015. It prevents you from opening an attachment in a PXE envelope if you use Java applet with IE11. The workaround is to use open online but that is very slow if you have large attachments. Is there any fix or fix date for this problem? I see there are 23 support cases so I assume it is getting some attention. Thanks for any info,

David Miller · ‎10-13-2014

Best thing to do with spam mails that ironport positively identifies as spam is to drop or quarantine on box if you must as it will nearly always be right. For suspect spam you can quarantine on box or forward to the recipient with a modified subject header e.g. [suspect spam] and use that with an outlook rule to put it in the user's junk mail folder. You can also use outbreak filter to modify the urls inside suspect spam to provide added protection.

David Miller · ‎10-13-2014

As the other answer says DLP only applies to outbound mail, and typically is used to look at email content not just the metadata (from, to, etc). You could try tagging the incoming email from the specific domain with an x-header (e.g. X-DoNotForward) and then in your outbound filter look for that header and reject any emails or bounce them back to the sender with a notification message. You do not need DLP to do this.

David Miller · ‎09-09-2014

You need to authenticate to encrypt to avoid spoofing. Previous versions of the plug-in allowed you to send an encrypted email without authentication, relying on the token in the plugin, but that only authenticated the domain not the user. So now you need to login to encrypt as well as decrypt.

David Miller · ‎03-10-2014

A way to allow your security team to access the virus quarantine is to define a custom user role (system admin / user roles) where you can define a role that only allows access to specified quarantines, and then specify just the virus quarantine. Then you can define a new admin user (system admin / users) that only has that custom role. All that use can then do is manage the virus quarantine. From there the user can search and view the message content, and download any attachments for offline analysis.

David Miller · ‎03-10-2014

Easiest to think of a user as a person in your organisation who sends email or receives email through the ironport. If a person has multiple email aliases that is still one user.

David Miller · ‎03-06-2014

Not saying this is the answer, but when Cisco provision a cloud email security system for a customer they provide self signed certs for all SSL/TLS protected transactions including TLS. One of the actions the customer has to perform is to replace those self signed certs with CA signed certs (if they wish). It may be that the domains you are looking at are trials or POCs and they haven't got round to providing signed certs, or they may have decided not to have CA signed TLS certs. It is perfectly valid to use self-signed certs, with the risk that if the "other end" requires signed certs then emails will be bounced or sent over unencrypted channels, according to policy.

David Miller · ‎03-04-2014

You need to enable authentication for the quarantine summary. This is set in IronPort Spam Quarantine Access Settings, and the options are None, LDAP or Mailbox (i.e. IMAP or POP). This is documented in the ESA Daily Management Guide or the online help. Hope this helps, kind regards, Dave

David Miller · ‎03-03-2014

As Robet has noted this is a known problem, and has been around for some time; about time it got fixed really, Cisco... The workaround for your recipient is to use "open online". On the envelope there is a link to open online, if they click that instead of the open button and enter their password it should decrypt correctly.

David Miller · ‎03-03-2014

There are suspendlistener and resumelistener CLI commands, log in to command line interface and these commands will prompt you for any required input.

Date Registered	‎06-19-2013 09:44 AM
Date Last Visited	‎08-18-2017 04:01 AM
Total Messages Posted	67
Total Helpful Votes Received	38

How about some logic like:

Could you use a regex to

Hi Mathew, were you able to

Zix Gateway with Cisco Technology

Hi Jason,Rather late response

Page can't be displayed error on IE11 o...

Best thing to do with spam

As the other answer says DLP

You need to authenticate to

A way to allow your security

Easiest to think of a user as

No TLS for Ironport Cloud?

Backdoor in Ironport (problems with oth...

CRES shows e-mail in Chinese characters

How to suspend/resume listeners during ...