I think we need to add the links for resources mentioned in the video. It would be also interesting to have the packages name in writing. How to find the Cisco Rep? Where is the Cisco Sales tool? We can improve visibility by adding graphs/text to the video. Thx. ... View more

I would recommend you open a Cisco TAC case first. Then, locate your account team and report the ticket number and the wish for the Enhancement Request. The technical side of the account team, meaning, SE (Systems Engineer) or CSE (Consulting Systems Engineer) should then be able to contact the business unit (BU) on your behalf. There is a tool that can be used to help you to find your account team. Hope that helps.   ... View more

What is the firmware version for your C670 devices? Perhaps you should consider: a) Get ESAv for the same version of C670; b) Load configuration from C670 in the C600V; c) Upgrade C600V to the version on C690 d) Load the Configuration from C600V on C690 It is not easy but it can be achieved. There is a configuration migration tool from hardware to virtual devices. The tool works for older versions of the AsyncOS through. Hope that helps. Regards, Valter ... View more

Hi Enrique, Differently from other platforms, CWS (Cloud Web Security) won't require the administrator to install/load the keys. Once the customer/partner buys the license, there is a process to provision the environment. Usually, the environment is provisioned before that process, during the POV (Proof of Value) phase. If you customer (or you) didn't run a POV and you are buying the product without the POV, you will need to get the environment provisioned, receive the information on how to access the CWS portal, create configurations and run some tests. After that, the environment is good to go, meaning, no need to get licenses/keys. The ordering guide can be found here (Cisco ScanSafe Web Security - Cisco) Hope that helps. Regards, Valter ... View more

You could bypass ASA limitation of using egress interface for redirection of WCCP, by using another interface. Since you mentioned you have a ASA though, I would recommend you to use PBR as a method for traffic redirection. Please refer to this document if you prefer to use PBR. https://supportforums.cisco.com/sites/default/files/tech_note_asa_pbr_for_wsa_0.pdf If you refer to AsyncOS 9.x User Guide, you will find a section named: "Using the P2 Data Interface for Web Proxy Data". I believe that will address your questions. Regards, Valter ... View more

Couple of options, Arun. www.cisco.com/go/pdihelpdesk That team can assist with sizing. Contact a Cisco CSE (Consulting System Engineer) in your region. If you drop me an email ( vdacosta@cisco.com ) I can assist you in finding that resource for you. Use our tool at :http://fwm.cisco.com In that http://fwm.cisco.com/ site you will also be able to download our Sizing Guide. I hope that helps. Regards, -Valter ... View more

Cisco ESA doesn't have a built-in archive capability. That being said, you could send the messages from McAfee to a quarantine on ESA, for instance. Cisco ESA could use a command like archive("Sample") but that will create a raw file with all the messages in a single file. Please refer to:http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa9-7/ESA_9-7_User_Guide.pdf Kindly search for "Archive Action". The direct link would be: http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa9-7/ESA_9-7_User_Guide.pdf#G11.1133841 Cisco has recently created a partnership with a third-party vendor that offers archiving. If you could please send me an email (vdacosta@cisco.com), I could get more information about what you are trying to achieve and advise you further. Hope that helps. -Valter ... View more

Would you please clarify the question?  Thanks. ... View more

That sender list is not From header of the email, when we are talking about the HAT (Host Access Table). It is the domain (or subdomain) portion of the FQDN (fully qualified domain name). Example: mailserver.domain.com If you add domain.com to the Sender Group SPAM, it won't matter the SBRS interval associated with SPAM sender group. All hosts that have domain.com in the FQDN will match to SPAM and their connection won't be accepted by ESA, as you said that you have the policy BLOCK, assuming that policy has connection behavior as "Reject". The HAT (Host Access Table) works from top to bottom, first match wins. So, if another sender group above the SPAM has domain.com, the a connection from a host named mailserver.domain.com would match that sender group.  So, to answer your first question directly, I would need to understand what you mean by "no sender specified". If that means no From header, that is correct. A connection from a host named mailserver.domain.com will be rejected based on the entry domain.com listed in the SPAM sender group, it won't matter the From header specified in the email message. In your second question it is not clear if you have the entry random.domain listed in the Sender Group. Assuming you have, then it wont matter the SBRS score. The connection from a host with random.domain in the FQDN will match with the sender group. Hope that helps. ... View more

The info from User Guide for AsyncOS 9.7 for Cisco Email Security Appliances: Graymail Classification The graymail engine classifies each graymail into one of the following categories: Marketing Email. Advertising messages sent by professional marketing groups, for example, bulletins from Amazon.com with details about their newly launched products.  Social Network Email. Notification messages from social networks, dating websites, forums, and so on. Examples include alerts from: –  LinkedIn, for jobs that you may be interested in –  CNET forums, when a user responds to your post. Bulk Email. Advertising messages sent by unrecognized marketing groups, for example, newsletters from TechTarget, a technology media company. ---- Hope that helps. ... View more

Hi, Please refer to both articles below: ESA FAQ: How do you whitelist recipient or sender emails? http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117913-configure-esa-00.html And How do you Whitelist a Trusted Sender? http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118585-qa-esa-00.html Please consider using tracing tool and logs to validate the configuration before making it to productions. Let us know if that helps, please. Regards, Valter ... View more

Effectiveness. It should be able to use Web Reputation and Security layers like Anti-Virus and Advanced Malware detection. It should be able to consolidate Visibility and Control of threats, usage and applications. Hope that helps. ... View more

Easier and supported way would be to clone the VM and added both to a cluster. Before cloning, it would be preferable to never start the VM. After you clone, you install the keys and run the config. Once the initial config is done, cluster them. If the primary ESAv is already in production, the easier way would be to spin up a new ESAv at the DR, install the keys, run the initial config and cluster it. Using scripts for a single operation like this I wouldn't advice. IT is not that you will repeat this many times. And, since you have a DR, you will probably spin multiples VMs. In case something is not working you can simply make a new ESAv ready by adding to a load balancer pool or changing firewall rules. BTW, ESAv supports snapshot and vMotion but this is not directly related to what you asked. Consider a side note. Automation and DR can be tricky. It is possible to add an ESAv to a cluster using CLI and remote commands. It can be a little more difficult to make sure everything is working just with scripts. There is a clustercheck command which can be issued to check the cluster consistency. Regards, ... View more