Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Enrico Werner
Stats
Member since
07-01-2010
96
Posts
67
Helpful
25
Solutions
08-30-2016
11:46 PM
AsyncOS does not deal with distribution lists. That is a matter solely for your Exchange server. For AsyncOS there is no mechanism to recongnize distribution lists. It will simply receive, scan and deliver the message(s).
... View more
08-30-2016
11:42 PM
You should find out if the event is associated with particular type of messages. Run grep on the CLI and search for the following in the text mail log file:
antivirus server error
This will give you the MID and with findevent you can get all details for each MID.
Also, check in the antivirus log file how often the watchdog error shows up. If you can link the events to some of your messages you can look into what you are sending through the ESA. If the events show too often I would suggest to open a case with TAC.
Addtionally make sure your AsyncOS version is a supported one!
... View more
Created by
Enrico Werner
in Security Documents
in Security Documents
08-11-2015
05:31 AM
08-11-2015
05:31 AM
Problem Description
C360s, C370s, C660s, C670s, X1060s, and X1070s with less than 8 GB of memory, under certain configurations and traffic, can lag from excessive memory use and swapping after you upgrade to AsyncOS 8.5.x.
Background
All C360, C660, and X1060 and the C370, C670, and X1070 appliances shipped initially have 4 GB of RAM and, under certain configurations and traffic, can lag (present delays) from excessive memory usage and swapping (when the operating system (OS) uses the hard disk as temporary memory) after you upgrade to AsyncOS 8.5.x.
Problem Symptoms
With certain types of traffic, especially when there is a spike in email traffic, the affected Email Security Appliance (ESA) models lag heavily. This latency is most common on ESAs with many features enabled, which include clustering and Security Management Appliance (SMA) connections that can contribute to the overall system lag.
For earlier software versions, there is a gradual slowdown due to excessive memory swapping. The current AsyncOS handles light and medium swapping situations with no noticeable lag, but heavy swapping situations result in the system entering a halt state. For the ESA platform, the duration of this halt state has been observed to be up to 5 minutes.
This issue causes slowness on the entire system and work queue backups. The overall experience is that the system is halted.
Workaround/Solution
X60 Hardware Upgrade Promotion
Customers that currently use C360, C660, and X1060s appliances and look to run 64-bit OS software images (8.0.x or later) might experience performance delays under certain configurations and traffic loads. This is a result of hardware configuration upgrades that have been made to the appliances since this hardware was released in 2012. A hardware upgrade promotion is available for a limited time for x60 customers in order to upgrade to the latest hardware. For more information on the program, send your requests to x60_HW_Upgrade_questions@cisco.com.
Memory Upgrade Kits for x70 Customers with 4 GB RAM
C370, C670, and x1070 appliances manufactured prior to December 2012 were configured with 4 GB RAM. Customers that run these appliances and look to operate 64-bit OS software images (8.0.x or later) might experience performance delays under certain configurations and traffic loads. A field upgradeable memory kit is available for these appliances in order to increase the memory to 8 GB RAM. Account teams will contact customers with the affected hardware and will provide these memory kits at no cost. For questions on this upgrade, contact x70_mem_upgrade@cisco.com.
How To Identify Hardware Levels
In order to verify the amount of memory in your appliance, complete these steps:
Access the CLI.
Enter the ipcheck command.
Look for "RAM Total" in the output.
RAM Total 4G
How to install the new memory kit
See the attached PDF file RAMupgrade.pdf (751 KB)
... View more
Labels:
Created by
Enrico Werner
in Small Business Support Service
in Small Business Support Service
11-26-2014
03:56 AM
11-26-2014
03:56 AM
Hi, the message was delivered to hotmail via DCID 105053215. This is the response from the hotmail server saying that it has accepted the message and queued for delivery: Message 43970558 to A@hotmail.com, B@hotmail.com received remote SMTP response ' <3b1c7703ee4ecf8b2d6b7345e7317272@XXX.com> Queued mail for delivery'.
... View more
10-31-2014
03:09 AM
With 7999 messages getting delivered, the question rather should be why was this one message not delivered, but put into the quarantine? If it was the CASE engine that flagged the message as Spam then check your outbound mail policies and consider disabling Anti-Spam scanning for outbound mail. CASE works best on inbound mail as it was designed for that and when enabled on outbound mail may cause false positives. (*If you have received the answer to your original question, and found this helpful/correct - please mark the question as answered, and be sure to leave a rating to reflect!)
... View more
09-24-2014
01:22 AM
The Cisco Security Management Appliance (SMA) allows an administrator to copy the active datasets (tracking, reporting and ISQ database) from the "source" SMA to a "target" SMA via the backupconfig command on the CLI. The backup process is executed in 2 phases: Phase 1 The backup process starts with the data transfer between the source and target appliances. During data transfer, services on the source appliance remain running, therefore data collection can still continue. Services though are shut down on the target appliance. Once the data transfer is complete from the source to target appliance, Phase 2 begins. Phase 2 When Phase 2 begins, services on the source appliance are shut down. Any differences that have collected during the data transfer between the source and target appliance since the initial shutdown are copied to the target appliance and the service is brought back up for both the source and the target. This allows for maximum uptime on the source appliance and no data loss for either appliance. There are two type of scheduled backups that you can perform on the SMA: Periodic Backups: Periodic backups consist of continual backups that can be scheduled for a predetermined time, or for a single backup that occurs at a predetermined time. Instant Backups: Instant backups occur immediately when the user initiates the backupconfig command on the CLI. Additionally, you can view or cancel scheduled and ongoing backups, check the status of a backup, or verify if a backup can be scheduled onto a remote machine. This all can be done using the backupconfig CLI command.
... View more
09-05-2014
03:53 AM
Hi, I was not able to figure out why AsyncOS would send this message after the upgrade, but basically it can be ignored as there is no centralized management key anymore in AsyncOS 8.5. The clusterconfig command is available by default. No key required anymore. So your cluster configuration remains also after the 60 days. For the exact reason why AsyncOS sent this warning feel free to open a TAC case. (*If you have received the answer to your original question, and found this helpful/correct - please mark the question as answered, and be sure to leave a rating to reflect!)
... View more
09-04-2014
11:26 PM
Hi, it is correct that the plug-in submits the message in RFC compliant format. So rolling the plug-in out to users is a good idea as more people will use the plug-in and our systems get fed with missed Spam which helps us in improving catch rates even better. Submitting false negatives using the plug-in is the best way to get rid if this junk! If there is Spam messages you submitted and you want to get feedback on those you need to contact TAC. In future releases of AsyncOS you will have the possibility to manage Spam submissions, which at the moment is not possible. Yes, version 8.5 will certainly add to the protection with URL filtering and Advanced Malware Protection (AMP)! Just keep in mind that lowering the Spam thresholds too much may cause false positives. You have better control if you send Spam into the Spam quarantine instead of dropping. With a score of 90 dropping Spam is ok.
... View more
09-04-2014
12:12 AM
Hi, the configured "Always Scan" size of 128K should be increased. The size of Spam messages has increased over time and therefore we recommend 256K or even 512K. If your appliance is not consuming too much of system performance already then you can configure 512K. Otherwise first start with 256K and very the impact. Messages smaller than the always scan size will be fully scanned, except in cases of “early exit.” If you keep 128K then messages larger then this will only run through a limited scan up to a size of 3 MB in your case. For more details, configuration checks and fine tuning I recommend reading this blog post. Best regards, Enrico
... View more
09-01-2014
05:07 AM
Hi Eric, the SMA only supports the certconfig CLI command. You cannot create CSR's on the SMA at all. For this simply create the CSR on the ESA and let it sign by a CA. Once you have the signed certificate you can load it into the SMA using certconfig. Also check this knowledge base article. You probably need to be logged in cisco.com in order to access the the article. (*If you have received the answer to your original question, and found this helpful/correct - please mark the question as answered, and be sure to leave a rating to reflect!)
... View more
08-25-2014
07:31 AM
Here it is: https://supportforums.cisco.com/document/33721/cisco-ironport-systems-contributed-tools
... View more
08-20-2014
01:52 AM
Hi,
this is a defect that can occur after upgrade to 8.5.6-074
https://tools.cisco.com/bugsearch/bug/CSCuq38174
Workaround:
1. User can login to cli and create another admin account for GUI use
2. User can continue to use CLI mode as admin
3. Administrator can still use direct URL calls to the correct page
for review. Example:
https://172.18.124.51/monitor/system_reports/system_status
(*If you have received the answer to your original question, and found this helpful/correct - please mark the question as answered, and be sure to leave a rating to reflect!)
... View more
08-14-2014
06:50 AM
Hi Doug, sounds like an inconsistent queue or the message is in either of the quarantines? For the inconsitent queue either email TAC and open a tunnel to have this fixed without mail loose, or suspend the appliance and wait until messages in the work queue are down to 0 and then run the resetqueue command. Read the warning carefully when you run resetqueue! Best regards, Enrico
... View more
08-06-2014
11:29 PM
Hi Chandan, Cisco will not replace appliances because of 4GB (or less) RAM installed. In the rare case you should encounter any significant performance issues please open a case with TAC so that we can identify the root cause of the issue. In most of the cases performance is impacted by unsupported configurations, high number of policies and filters with nested body scanning actions, incorrect AS/AV settings, incorrect listener settings etc. Best regards, Enrico
... View more
06-30-2014
01:44 AM
I was not able to reproduce this on 7.6.3-019 and FF version 30. I created a test user with password expiration of 1 day. After one day I was required to change the password which worked perfectly fine and I was also able to login with the new password. I'd recommend to open a case with TAC so that that we can continue looking into the issue. Provide the URL of this post when you open the case. Best regards, Enrico
... View more
08-30-2016
AsyncOS does not deal with distribution lists. That is a matter solely
for your Exchange server. For...
08-30-2016
You should find out if the event is associated with particular type of
messages. Run grep on the CLI...
Created by
Enrico Werner
in Security Documents
08-11-2015
08-11-2015
Problem Description C360s, C370s, C660s, C670s, X1060s, and X1070s with
less than 8 GB of memory, un...
11-26-2014
Hi,the message was delivered to hotmail via DCID 105053215. This is the
response from the hotmail se...
10-31-2014
With 7999 messages getting delivered, the question rather should be why
was this one message not del...
09-24-2014
The Cisco Security Management Appliance (SMA) allows an administrator to
copy the active datasets (t...
09-05-2014
Hi,I was not able to figure out why AsyncOS would send this message
after the upgrade, but basically...
09-04-2014
Hi,it is correct that the plug-in submits the message in RFC compliant
format. So rolling the plug-i...
09-04-2014
Hi,the configured "Always Scan" size of 128K should be increased. The
size of Spam messages has incr...
09-01-2014
Hi Eric,the SMA only supports the certconfig CLI command. You cannot
create CSR's on the SMA at all....
08-25-2014
Here it
is:https://supportforums.cisco.com/document/33721/cisco-ironport-systems-contributed-tools
08-20-2014
Hi, this is a defect that can occur after upgrade to 8.5.6-074
https://tools.cisco.com/bugsearch/bug...
08-14-2014
Hi Doug, sounds like an inconsistent queue or the message is in either
of the quarantines? For the i...
08-06-2014
Hi Chandan,Cisco will not replace appliances because of 4GB (or less)
RAM installed. In the rare cas...
Public Statistics
| Date Registered | 07-01-2010 06:05 AM |
| Date Last Visited | 08-27-2019 06:58 AM |
| Total Messages Posted | 96 |
| Total Helpful Votes Received | 67 |
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 14 | |
| 5 |
