About Doug Maxfield

Doug Maxfield · ‎08-22-2018

Are you using SPF at all? If not, that is your problem. We ran into that about 3 months ago and as soon as we created and implemented a SPF record, emails were delivered to Gmail.com. Doug

Doug Maxfield · ‎08-16-2018

I would open a TAC and inform them what has changed and what the problem is. They should be able to get you in touch with licensing and get you new keys. Doug

Doug Maxfield · ‎07-13-2018

Instead of "dropping" the attachment, why don't you place them in a Quarantine. That way, they can be review and gives you the ability to release the emails with the attachment included.

Doug Maxfield · ‎07-11-2018

Thanks for the help. Creating another interface would not be ideal due to us being Cloud ES. Also, we had issues in the past with having this as a MX record as some MTAs would "round-robin" our MX records and we specify the addresses to accept in the RAT. Doug

Doug Maxfield · ‎07-11-2018

Thanks for the information, but it doesn't appear to be getting logged. I sent myself a test email and attempted to run the command provided, and got zero results. I then downloaded the entire mail.current file to my PC and used Notepad++ to search for the item, I could not find anything. I was able to see the email that I sent in the mail.current log, but nothing showing that the address had been rewritten. I even reviewed the headers of the email coming in and they show no trace that the email was originally sent to @subdomain.domain.com Doug

Doug Maxfield · ‎07-11-2018

Good Morning, We have a configuration in the listenerconfig for domain mapping that rewrites anything from "subdomain.domain.com" to "domain.com". We are working towards decommissioning the subdomain but would like to know how many emails are coming in with that address. We have looked in the mail logs and can't find any entries of the rewrite but know it's in use. Is there a way to find out how many of these emails we are receiving daily? Thanks in advance, Doug

Doug Maxfield · ‎07-05-2018

Thanks Dennis!!!! You might want to have someone revise the document that I quoted, if it is still valid. It includes the dash. Doug

Doug Maxfield · ‎07-05-2018

Dennis, We are not using SPF, DKIM or DMARC currently, but on our "radar". Sounds like we may need to advance this a little quicker. Since we are using Cloud ESA, we are thinking of adding the following SPF record: v=spf1 -exists:%{i}.spf.hc1830.iphmx.com -all Got the above from Cisco Cloud/Hybrid Email Security Overview, Published July 28, 2017, Revised January 25, 2018. Will this work? Thanks!!! Doug

Doug Maxfield · ‎07-05-2018

Good Afternoon, We are currently using Cloud ESA. We were made aware of an issue with users attempting to send emails to Gmail.com that are being queued by the following message: (DCID 4525300) Message 5384539 to ***************@gmail.com delayed. Reason: 4.3.2 - Not accepting messages at this time ('421', ['4.7.0 This message does not have authentication information or fails to pass', '4.7.0 authentication checks. To best protect our users from spam, the', '4.7.0 message has been blocked. Please visit', '4.7.0 https://support.google.com/mail/answer/81126#authentication for more', '4.7.0 information. b23-v6si6305592pls.341 - gsmtp']) [] In reviewing our logs, we noticed that this issue has been happening since 6/8/18. When it 1st started, we were seeing delays of about 3 - 4 hours. Now, we are upward of almost 24 hrs. We have opened a TAC on this issue but wanted to see if anyone else is experiencing this problem. We are not running any SPF, DKIM or DMARC on the Cloud ESA. Thanks in advance for any help/information. Doug

Doug Maxfield · ‎06-11-2018

Robert, We also found this guide: https://www.cisco.com/c/dam/en/us/td/docs/security/ces/overview_guide/Cisco_Cloud_Hybrid_Email_Security_Overview_Guide.pdf We do have a question on page 2-2 of the doc. It specifies the following: v=spf1 -exists:%{i}.spf..iphmx.com -all What does the %{i} mean? Thanks, Doug

Doug Maxfield · ‎06-07-2018

Good Afternoon, I'm looking to find a Whitepaper explaining what needs to be done to setup SPF, DKIM and DMARC in Cloud ESA. I have the whitepaper "Email Authentication Best Practices; The Optimal Ways to Deploy SPF, DKIM and DMARC" Revision 4, dated Aug 1, 2017. But it appears to be more gears to the Appliances or Virtual offerings. I have searched the Cisco site but can't find anything. Any help is appreciated. Thanks, Doug

Doug Maxfield · ‎05-24-2018

We recently got "caught" on this. We had our ciphers too strong and we were not able to communicate with another sender, who happened also to be using a Cisco ESA. After some discussions on the forums and Remote Access, we were able to determine the best cipher to use, which I believe is the recommended one by Cisco: MEDIUM:HIGH:-SSLv2:-EXPORT:-aNULL:@STRENGTH Since changing to that, we have had zero problems with anyone set to "Required" TLS. Hope this helps. Doug

Doug Maxfield · ‎05-18-2018

Update on this: We were able to get the Auto Remediation working correctly. The step that I questioned about yesterday should be the path in your O365 deployment to get to OWA. In our case, it was https://outlook.office.com/OWA. I also believe that we may have missed a step in configuring the required permission. We set them, but believe that we forgot to select the "Grant Permissions" option. After doing those 2 items, we were able to successfully connect from cESA to O365 with the Connect Check test. Doug

Doug Maxfield · ‎05-17-2018

Sorry to bring up an old thread. We are looking at this again and believe that we have gotten much closer. The "int" error is gone and now it looks likes it's a connection error: Connection Unsuccessful. Details: Unable to connect to Office 365 services with the specified parameters. Please verify Azure AD details and retry. I believe I might know where the problem is but need some clarification. Going through the Auto Remediation for Office 365 guide, on page 6, in the section "Register your CES Cluster as an Application in Azure", #6 says "Sign-on URL in the form, with a note that says "This is the URL where users can sign in an use your appliance." What are we looking for here? I put in our cESA URL and that isn't working. But our users are not allow access to the cESA except for Spam Quarantine. Are you looking for our O365 OWA access? Just need some help to figure it out. The document that I'm using is dated 2016. Is there a new document to follow? Thanks, Doug

Doug Maxfield · ‎05-04-2018

Good Morning, Our Cloud SMA was upgraded last night to ver 11.4. Love the new interface!! Just 1 question that I have. From the console, when attempting to open up the Spam Quarantine, it opens in a new tab and I have the option to "try the new look". When I click on that, it opens up a new tab and brings me right back to Spam Quarantine with the old look. Has anyone else experienced this? If so, what was the solution to fix? I'm using the latest version of Chrome. I've also tried it in Edge and get the same results. Just thought that I would check here before opening a TAC on this. Thanks!! Doug

Date Registered	‎02-03-2011 11:57 AM
Date Last Visited	‎09-12-2018 01:47 PM
Total Messages Posted	106
Total Helpful Votes Received	28

Re: M680 Ironport delayed messages

Re: After Hardware replace Feature Keys...

Re: Office documents 97-2003 OLE embedd...

Re: Tracking of domainmap rewrite

Re: Tracking of domainmap rewrite

Tracking of domainmap rewrite

Re: Problems sending to Gmail

Re: Problems sending to Gmail

Problems sending to Gmail

Re: Configuring SPF, DKIM and DMARC in ...

Configuring SPF, DKIM and DMARC in Clou...

Re: Need help to increase the Cipher st...

Re: We have followed the

Re: We have followed the

Question on Cloud SMA upgrade