Incoming mail is from the domain of the IP of the sending mail exchange box NOT the envelope sender. For gmail, their mail exchange boxes are all on the google.com domain. ... View more

To be clear, are you forwarding all of them to the same address? ... View more

If you're keeping any sort of AD account or contact for them with the old email address in it, create a POLICY that is based on the recipient address (which can be an LDAP group that you query from AD), and in that policy you create the content filter(s) with no criteria, but all of the actions you need... Eg .strip attachments, bcc to address, drop this message You want to use a policy to separate these out because you want the DROP to happen to the messages that are intended for the ex-employees but not current employees for cases when the incoming message has both in the recipient list. e.g. if I send a message to "Ex-emp@yourcompany.com,current-emp@yourcompany.com " a policy will splinter that into 2 messages an process them separately, while a content filter that uses the recipient condition will get 1 message and if the final action is drop, NO ONE gets the message. ... View more

Download Postman from here: https://www.getpostman.com/   Follow the steps in that getting started doc to turn on the API.     Open postman, create a collection and a request (I forget what order it prompts for them)   Select Basic Auth, and enter a username and password Enter the url/request in the box, try something like this:  https://<ESA>:6443/api/v1.0/stats/mail_outgoing_traffic_summary?1d Hit send.     In your case, you may want to do a time based thing instead of “1d” which is the past 24 hours, if you want your query to be based on calendar day.  That's covered in the API doc...     ... View more

Looks like there aren't any counters available via SNMP So its API start here: https://www.cisco.com/c/en/us/td/docs/security/esa/esa_all/esa_api/b_ESA_API_Getting_Started_Guide/b_ESA_API_Getting_Started_Guide_chapter_00.html ... View more

You could look at the reporting API, or SNMP... ... View more

Mail will still flow SBRS, CASE, AV, AntiMalware all stop. ... View more

No, WCCP can't forward traffic "through" the firewall. Is your DMZ between the inside interface of an outer firewall and the outside interface of the inner fw? You could use WCCP off of either of those (I'd do the WCCP on the inside interface of the outer firewall) Ken ... View more

I know there is a similar enhancement request for the bypass list, because a comma delimited list of anything is hell to work with... ... View more

OHHH. Yeah, in that case with OpenLDAP, you don't have the issue with the WSA joining an AD, so you'd just have to have a hole for the WSA to talk to your LDAP boxes, which would be cleaner. We have a segment between the core and the firewall, that's where the WSAs and Email Security Appliances sit. ... View more

With PAC files you'll be able to redirect the traffic out to the DMZ. How are you going to do authentication?  If you look at ISE-PIC (the replacement for CDA) you may be able to sent authentication info out to the WSA's.  I think you'd still have to join the WSAs to the AD to make them completely happy...   Since the WSA is basically a stand-in for the workstation that browses the internet, I don't see it as any different than a workstation... ... View more