Before you posted ppreenja, under HAT I created a new AMAZONAWS sender group and added those IP ranges in.  I made the SenderBase reputation score from 0 to 10.  The mail flow policy I created was TLSREQUIRED which basically REQUIRES TLS (drop if it doesn't).  My thought was I figured if the sender used TLS and it had a 0 to 10 SBRS score, it should help somewhat from bad guys who don't thoroughly pay attention to all of the details spinning up spam or phishing email servers in AWS.   This seemed to work.  But then today even though it seemed that email was working fine... two vendors inquired via Skype for Business about email bounce backs (Our organization rejected the message).  Looking through some message logs it seemed like every email was being detected and applied to the AMAZONAWS sender group, even if the IP address DID NOT MATCH the 4 CIDR IP addresses.  The HAT overview screen was in this order: 1 CISCO_CRES     TLSREQUIRED 2 RELAYLIST     RELAYED 3 WHITELIST     TRUSTED 4 BLACKLIST     BLOCKED 5 SUSPECTLIST     THROTTLED 6 AMAZONAWS     TLSREQUIRED 7 ACCEPT-TLS     ACCEPTED 8 UNKNOWNLIST     ACCEPTED ALL     ACCEPTED   So this time I tried reordering it like so: 1 CISCO_CRES     TLSREQUIRED 2 RELAYLIST     RELAYED 3 WHITELIST     TRUSTED 4 BLACKLIST     BLOCKED 5 SUSPECTLIST     THROTTLED 6 ACCEPT-TLS     ACCEPTED 7 UNKNOWNLIST     ACCEPTED 8 AMAZONAWS     TLSREQUIRED ALL     ACCEPTED   I sent a test email from my gmail account and in the message logs it detected it as ACCEPT-TLS sender group.  I also had a vendor resend me an email that was "rejected by our organization" and it now came through this time (they are not using Amazon AWS either).  Now I don't have an Amazon AWS email system I can test to see if that is detected properly, but does anyone know what is going on?  Will my reordering work? Yes ppreenja, you have a full understanding of our rule.     Here is the text based filter we have when I SSH to the ESA and view it: (since this is a publicly accessible forum I changed our actual domain name in here to simply domain.) 1 Y Y Anti-Spoofing Anti-Spoofing: if sendergroup != "RELAYLIST|WHITELIST|AMAZONAWS" { if (header("from") == "(?i)@domain\\.com") OR ((mail-from == "(?i)@domain\\.com") OR ((header("from") == "(?i)@domain\\.org") OR (mail-from == "(?i)@domain\\.org"))) { quarantine("Spoofed"); } }    ... View more

Hi I need Patch 6, where is the download?  I can't find it in Cisco's search box for software downloads, and its not under the Security category.   Does anyone have a link?   ... View more