Something like this? :compareheaders if (rcpt-to == mail-from) { drop(); } I haven't tested, and the help isn't clear, but it should... ... View more

I can't think of any place tha ESA uses NTLM... Spam quarantine login is via ldap or if you allow it, magic links in the notification email... no NTLM involved. ESA isn't joined to the domain... WSA uses it for transparent auth... ... View more

There doesn't appear to be a way to do this. You could create a set of content rules, one for each policy, and have that content rule add a custom log entry, so you'd get something you could use to tie specific messages to specific policies. ... View more

No...not MD5 You can search for SHA256, assuming you have AMP. ... View more

Create a condition in the filter so this only applies to messages that don't have the text of the disclaimer in the body. What ends up happening is you get one copy in a thread of back and forth emails. ... View more

Care to share which feeds you're looking at? ... View more

1. Yes, that's the "normal" mode of deployment. The ESA can appear as a device in the AMP for Endpoints console when its registered to their AMP4E account. 2. Its on prem, you just need the AMP for ESA SKU. 3. AMP is part of the AsynchOS image. Registering to the customers AMP for Endpoints console was added in 11.1. You really need to get them upgraded to 12 when it goes GA. They added a huge list of other files that the ESA could send to AMP and made it smarter about what really needs to go to AMP for an actual net reduction of files uploaded for inspection. ... View more

Pretty sure you have to get a license file on it first... Find your XML license for it. Open in Notepad copy the contents. Then on the ESAv enter "loadlicense" and paste in the file. Hit enter, then CtrlD ( I think. It will tell you) Then you can run systemsetup. ... View more

I'm a little unclear on what you're asking, but I'll try to answer:   For outbound mail, the other sites will typically refuse mail for accounts that don't exist during the mail transaction, and your ESA will bounce it back.  The issue is not everyone does it early (eg during the receive) and not everyone will bounce it back, they could just dump it. You could use SMTP call ahead, but I'm not sure if that applies to you... Taken from the help: The SMTP call-ahead recipient validation feature queries an external SMTP server before accepting incoming mail for a recipient. Use this feature to validate recipients when you cannot use LDAP Accept or the Recipient Access Table (RAT). For example, suppose you host mail for many mailboxes, each using a separate domain, and your LDAP infrastructure does not allow you to query the LDAP server to validate each recipient. In this case, the Email Security appliance can query the SMTP server and validate the recipient before continuing the SMTP conversation. You can use SMTP call-ahead recipient validation in order to reduce processing on messages for invalid recipients. Typically, a message for an invalid recipient progresses through the work queue before it can be dropped. Instead, an invalid message can be dropped or bounced during the incoming/receiving part of the email pipeline without requiring additional processing. ... View more

Yes. You can spin up as many as you need, you just apply the same license file to each one. DO make sure that you're buying enough seats... failing an audit is never cheap. ... View more

You can order just VMs you dont have to buy physical appliances. Vms are licensed per seat, so you can spin up the number and size based on your requirements. ... View more

  Now when we changed the service account type from user to admin, xxxproxy1 account created and realm creation was successful.   Can you please confirm whether admin previleges are required to permanently or whether the same can be changed to user (since account is already created),  Once the WSA is joined to the domain, it uses its machine account to verify user identity, so whichever account joined it to the domain isn't used any longer.    If you use an LDAP realm for basic auth or external administrative user logins, it does NOT have to be an admin, a normal user will work.  ... View more

The HA feature on te WSA is sort of like Router HA, the WSA takes over the other boxes 'identity" . With them in different data centers this wont work. SInce you can get licensing to match your WSAs for VMs for free, you could stand up a VM next to each hardware WSA, and WCCP will balance and failover the traffic for you. ... View more