Hello Claire, I am not quiet certain what your process flow is actually, is Symantec DLP an external host the ESA delivers to, or is it installed on the Exchange server? I am asking because it seems there is a policy on Symantec DLP that creates a notification, but then passes the message to the exchange server.   Regards, Andreas ... View more

Hi Michael, words in dictionaries are seen as regular expressions, thus an entry like .exe would also match on a word like june_executive_summary.pdf   (in regular expressions, the single period (.) represents a character)   To match extensions only, you can add a $ sign to the entry, which means "only at the end of a filename".  Also masquerade the period, so it it is seen as one.   \\.cab$ \\.exe$   Also make sure the dictionary has the " Case Sensitive"  checkbox unchecked.     Hope that helps, Andreas ... View more

Hello Mark, in general spam efficiency reports would not work for individual, mainly because the spam detection process is not only limited to the spam engine, the major work is actually done by the reputation engine. In other words, senderbase, which on average blocks more that 90% of all connection attempts, mostly from hosts with a score of -5 or worse. By default these connections are already dropped before sender and recipients are injected, so the system is not aware who the potential spam was targeted for. You could work around this by enabling delayed HAT rejection, which would still wait until sender and recipients are injected, before disconnecting.  In this case, you can check   GUI: Monitor->Incoming Mail   specify a time range, and then enter the internal user in the search field below the main table. Or leave it empty and just hit "Search" for a list of all users, the list then can be sorted by clicking on the column names.  The result table will contain entries like "Total Attemted" and "Spam Detected", and of course the results can be exported as well.   Hope that is what you are looking after. Regards, Andreas   ... View more

Hello Keith, you are correct that the ABA Identifier causes false positives, this also happens for SSN identifiers, simply because the format does not have any checksums or the like to confirm this is really an ABA or SSN.  There are two possible approaches for that, one would be to purchase DLP, which is indeed contextual aware when it comes to this kind of data.  Another approach without DLP would be at least one more condition to the ABA smart identifier, i.e. a dictionary with words like "account", "transfer", "bank" etc.  Combining both conditions with a AND statement (only if all conditions match) should work without causing much more false positives. That's after all how DLP works as well.   Hope that helped, Andreas ... View more

Hello uniqueshipping, this is most likely an MTU problem, there is a five minute gap between the recipient being added, and the connection getting lost. What we see here is a standard TCP timeout, caused by the appliance not seeing any data sent, which happens at the moment when the sender issues the "data" command, to send the main email body. This is when larger packets will be send, and an MTU mismatch between sender and recipient will cause packet truncation. Please check if ICMP is blocked on your firewalls, this needs to be enabled in order to get MTU path discovery, which is responsible for negotiating the correct packet sizes between two hosts. As a temporary workaround, you could also lower the MTU on your incoming interface, but note that this is not considered a permanent solution.   Hope that helps, Andreas ... View more

Hello Shawn, there is a difference between the workqueue (messages in workqueue) and delivery queue (active recipients). SMTP Routes, Destination Controls etc. work on delivery indeed, however there is currently no prioritization you can set on the workqueue, do get messages from one sender processed faster than from others.  You can address this in a slightly different way though, for instance by setting up limits on receiving for all hosts but the ones you want to prioritize, to prevent that the workqueue is building up. A common setting used for this is the "Rate Limit for Envelope Senders" in the mail flow policies. Activating this will limit the rate of messages injected per sender address, for a given time frame (default is 60 minutes, but can be changed). You could activate this setting in all mail flow policies, except the one for the senders you want to prioritize, or, use the "address list" for excluding senders from this policy.     Hope that helps, Regards, Andreas ... View more

Hello Rachel, IP Address ranges will never work reliably for countries, as there are no specific assignments that are used exclusively by specific countries. This is especial true as we live in a hosted world today, where a domain may not be hosted in the country it is target for.  So you are left with filtering top level domains only, an efficient approach would be to create two incoming mail policies, and a content filter with no conditions, and a single action "Bounce", or "Drop".  The first of the mail policies would be your exception list, where you add all the recipients of your staff that you want to exclude from the country blocking policy. Enable all services there such as antivirus and antispam.   In the second policy add the top level domain you want to use as sender, in the form of: @.tld In this policy, disable all services and filters, and only enable the Bounce or Drop filter you have created before (and enable it in that policy only). Make sure the exception policy is placed before the TLD policy. You want to use policy in order to enable mail splintering, i.e. if a message from such a TLD contains multiple recipient of users you want to except, and normal users. A filter matching on one of these would either block the message for all recipients, or deliver it to all recipients, thus violate the policy.   Hope that helps, Andreas       ... View more

Hello pemasirid, as far as I can see from your description is that you add the ESA C370 as an additional gateway, so I would say there is little you need to change in your current network design. As this is all about SMTP getting forwarded, you basically just need to take care of the following things:   On Forefront: Allow injections from the ESA(s) and forward all outbound messages to the ESA On the ESA(s): Insert the Forefront IPs into the RELAYLIST of the private listener to allow outbound messages. Also set up an SMTP route to forward inbound messages to the Forefront server. Also change public DNS to point to the public IPs of the ESAs, in case they are different from what you have used before   A good starting point for deploying would be the Quickstart Guide for C370, that you can find in the support section for email security on Cisco.com. Also, the user guide, which is also available on the GUI of every email appliance (GUI: Help and Support -> Online Help).   Hope that helps, Andreas ... View more

Hello Bighead81, could you explain what you mean by "single process of content filter" please?  I'd suppose adding more than one content filter to a policy, which should be no problem. Also activation of Content Filter, Outbreak Filters and DLP (for outbound mailflow) for any policies.   Regards, Andreas   ... View more

Hello Paresh, the Email Appliances do not provide such a report, basically because an SLA is very much dependent on external factors, i.e. availability of a remote host (mailbox full), an email provider that throttles traffic, etc. Instead I would recommend looking for the status reports and logs instead, where a high number of  messages in workqueue indicates receiving problems, and a high number of active recipients indicates delivery problems. Looking at these numbers will easily help you to detect potential problems when they occur.   Hope that helps, Andreas ... View more

Hello Ravi, if I understand you correctly, you have enabled sender authentication on your Exchange server for all incomming messages? In this case, you need to configure autgoing authentication on the ESA with a username and password for the Exchange server. The setting can be found under: GUI: Network->SMTP Authentication Choose to add a new profile, and make it "Outgoing", then provide the username and password the Exchange server was set up to accept incoming messages. Once submitted, also create an SMTP route for that Exchange server, where you specify the outgoing authentication profile. The user guide has a nice step by step tutorial for that, check the online help of the appliance for "Configuring AsyncOS for SMTP Authentication" Hope that helps, Andreas ... View more

Hello Greg, mail policies match on email addresses only, not on IP addresses, this is per design, so like Juraj stated you would need a filter condition to do the tasks.  Another solution is also to create a sendergroud in the HAT that includes all the IPs you want to match on, and then use the 'sendergroup' condition in message filters to match on this group. Here is an example from the Advanced User Guide: if (sendergroup == "Internal") { alt-mailhost("[172.17.0.1]"); } The advantage of this solution is that you can edit the list of IPs on the GUI, without changing the filter itself, so that would be more maintenance friendly. Hope that helps, Andreas ... View more

Another possible scenario would be a group query on an incoming mail policy. If you can write a query that returns a positive match for an existing account (i.e. because the address is part of the user group), the message enters this mail policy, where you have a content filter that redirects the message to your Exchange Server. Otherwise, the message will go to the default mail policy, where you can have another filter redirecting the message to a different server. This solution also works with multiple recipients, where a part exists in AD, and a part does not. Hope that helps, Andreas ... View more