Hi John, Excellent questions! Let's take them one by one. 1A) To determine if the recipient's server is accepting my TLS connections: Our first step is to determine a host we want to verify TLS against. This may be as simple as searching your message tracking for connections to a particular domain, or you may have to use a tool such as `dig` or `nslookup` to determine the mx record for the domain you wish to check. I'll use cisco.com as an example. test.box> dig mx cisco.com ; <<>> DiG 9.4.3-P2 <<>> cisco.com MX ;; global options:  printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18084 ;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;cisco.com.                     IN      MX ;; ANSWER SECTION: cisco.com.              86400   IN      MX      10 rcdn-mx-01.cisco.com. cisco.com.              86400   IN      MX      15 ams-mx-01.cisco.com. cisco.com.              86400   IN      MX      15 rtp-mx-01.cisco.com. cisco.com.              86400   IN      MX      15 alln-mx-01.cisco.com. --- In my scenario, I'd like to verify that I can negotiate a TLS connection to rtp-mx-01.cisco.com. In the current versions of AsyncOS, there is a built-in command called `tlsverify` which will automate this for us. Once we have the domain and mail exchanger for that domain, we can plug them into `tlsverify` and the IronPort will do all the work for us --- test.box> tlsverify Enter the TLS domain to verify against: []> cisco.com Enter the destination host to connect to.  Append the port (example.com:26) if you are not connecting on port 25: [cisco.com]> rtp-mx-01.cisco.com Connecting to 64.102.255.47 on port 25. Connected to 64.102.255.47 from interface 1.1.1.1. Checking TLS connection. TLS connection established: protocol TLSv1, cipher RC4-SHA. Verifying peer certificate. Verifying certificate common name rtp-mx-01.cisco.com. TLS certificate match rtp-mx-01.cisco.com TLS certificate verified. TLS connection to 64.102.255.47 succeeded. TLS successfully connected to rtp-mx-01.cisco.com. TLS verification completed. --- Success! We can now be confident that if we do set TLS to preferred or required, that our connections to this mail host will be successful. As a precautionary measure, we shoiuld check all 4 MX records to ensure we receive the same successful results. --- If we should happen to check a domain that does not negotiate TLS with our IronPort, `tlsverify` will show us the error so we know why our connection failed. --- Would you like to verify another domain? [Y]> Enter the TLS domain to verify against: [cisco.com]> bigfakedomain.org Enter the destination host to connect to.  Append the port (example.com:26) if you are not connecting on port 25: [rtp-mx-01.cisco.com]> mail.bigfakedomain.org Connecting to 2.2.2.2 on port 25. Connected to 2.2.2.2 from interface 1.1.1.1. Checking TLS connection. STARTTLS command not supported at 2.2.2.2. TLS was required but could not be successfully negotiated. Failed to connect to mail.grapeape.org. TLS verification completed. ---- From the output above, we see that the STARTTLS command is not supported on the remote host. This tells us they are not advertising TLS, and it is not possible to negotiate a TLS connection with that host. 2A) When configuring your listeners, you can choose from three states for TLS: 1.  Off  - No TLS connections are attempted 2.  Preferred: TLS can negotiate from the remote MTA to the Cisco IronPort appliance. However, if the remote MTA does not negotiate (prior to receiving a 220 response), the SMTP transaction will continue "in the clear" (not encrypted). No attempt is made to verify if the certificate originates from a trusted certificate authority. If an error occurs after the 220 response is received the SMTP transaction does not fall back to clear text. 3. Required: TLS must be negotiated from the remote MTA to the Cisco IronPort appliance. No attempt is made to verify the domain's certificate. If the negotiation fails, no email is sent through the connection. If the negotiation succeeds, the mail is delivered via an encrypted session. Hope that helps, --Woody ... View more

Hi John, Good questions! 1A) An intermediate certificate is a "subordinate" certificate issued by the trusted root Certificate Authority (CA) specifically to issue end-entity server certificates. The Certificate Authority can be thought of as a central repository that can be checked against to verify identity. When you purchase an SSL cert, what you are really paying for is a certificate chain that begins at the trusted root CA, through the intermediate and ending with the SSL certificate issued to you. Such certificates are called chained root certificates. Intermediate certs are important because creating certificates directly from the CA root certificate increases the risk of root certificate compromise. If the CA root certificate is compromised, the entire trust infrastructure built by the SSL provider will fail. The usage of intermediate certificates for issuing SSL certificates to end entities provides an added level of security. Keep in mind that using intermediate certificates does not cause installation, performance, or compatibility issues. 2A) To verify that your cert is signed with the correct key is fairly straightforward. All you need is an openssl binary for your workstation's operating system. Generally, this is included in Linux/Unix, but is available for download for Windows at http://www.openssl.org Once you have SSL installed on your workstation, you can run the following two commands to check the certificate against the key. Basically, we are looking for the ouput to be *exactly* the same. If it is, you can be confident that you have the correct cert/key pair. If it is not, then you should consider redownloading the certificate from your issuer, and ensuring you are using the correct key ( check the file's timestamp, etc.... ) Run the following command for the cert: openssl x509 -noout -modulus -in server.crt | openssl md5 Run the following command for the private key: openssl rsa -noout -modulus -in myserver.key *The modulus results for the cert and key should be the same.* Example: OpenSSL> rsa -noout -modulus -in xyz.key Modulus=E7308831C44B4C464CF620DD9D1BE12961EF308490F7F7A6F5B0F6F6E58733D2FFAA2A77 4C21335DE48A753A8398F0965E5C55570F551EE9B70725241742BCB5F857ED2347D49384E10F86E1 3E2BD3E8E2CDE11FA91062D08A522DA3E01D48A50175F2B50C9C8821202B1482CD453243E429842A E65BFDE72F92E8071FC5466631EBCB84E0814059FDDD9B2A8E780E58E4F0F530069989335249E32C 8AD8628231B67DD3076EF51FC430453901F7645B04B68D94F6721FBABDB07D18792584C6E57793E6 AF012BB6FE20484D440FCE7DB2D9347F62BB8AD797839E2D42C144BEFA2DCB6CA8C8E7B220890C81 C8E7050EB5638CBE4D81AEF0D6803BF06153A405 OpenSSL> x509 -noout -modulus -in xyz.crt |md5 Modulus=E7308831C44B4C464CF620DD9D1BE12961EF308490F7F7A6F5B0F6F6E58733D2FFAA2A77 4C21335DE48A753A8398F0965E5C55570F551EE9B70725241742BCB5F857ED2347D49384E10F86E1 3E2BD3E8E2CDE11FA91062D08A522DA3E01D48A50175F2B50C9C8821202B1482CD453243E429842A E65BFDE72F92E8071FC5466631EBCB84E0814059FDDD9B2A8E780E58E4F0F530069989335249E32C 8AD8628231B67DD3076EF51FC430453901F7645B04B68D94F6721FBABDB07D18792584C6E57793E6 AF012BB6FE20484D440FCE7DB2D9347F62BB8AD797839E2D42C144BEFA2DCB6CA8C8E7B220890C81 C8E7050EB5638CBE4D81AEF0D6803BF06153A405 Hope that helps --Woody ... View more

Philippe, Unfortunately the KBs are limited as there is currently no support for loading/reloading configuration files from/to clustered appliances. As you've problably seen, the configurations get quite complex as each new machine is added to the cluster. That doesn't mean it cannot always be done, as you've found.  If I were to attempt large changes on a cluster, I would probably take the route you already use, and do it programmatically. Thanks, --Woody ... View more

Hi Philippe, It's true that the more rules you deploy, the more processing time and power needed to evaluate them all. What I would recommend in a situation such as yours would be the usage of dictionaries to combine similar filter expressions, along with a single content or message filter to evaluate it. This is explained in a Knowledge Base article here: https://supportops.sfo.ironport.com/kb/index.php?cc=disp&id=640 Basically, if we took ex-employeees as an example, we could do the following. 1) Create a dictionary containing the email address of ex-employee ( one per line ) 2) Create a single content filter to evaluate if the recipient of the message is contained in that dictionary, and process it accordingly ( bounce, drop, respond with a template stating the address is no longer valid) Dictionaries make it exceptionally easy to aggregate multiple filters into one filter which is basically scanning a text file for information on what to search for. Now, along the lines of singular filters, which wouldn't benefit from using a dictionary, I can only recommend standard maintenance. The IronPort's gui is quite effective as removing/disabling Content Filters which are no longer needed. Unfortunately ( or not, depends on how you look at it ) , Message Filter administration is still a CLI-only process. That being said, you would generally always have more Content Filters than Message Filters. Given their nature, Message Filters are more suited for broad actions; eg: drop any message coming from my external listener with my domain name as the sender.  Content Filters are more fine-grained, allowing for splintering of recipients, which allow singular recipients to be acted upon in a multi-recipient message. Hope that helps, --Woody ... View more

Doug, Absolutely, no problem. I can't give away too much of our "secret sauce" , but rest assured every message is taken into account. As you can imagine, all this is more automated than human, but there are always engineers sampling and verifying submissions to enhance our antispam rulesets. We appreciate all submissions we receive, and the fact that you are encouraging users to submit. Submissions make the system better, and that's what we're all striving for. Let your users know that IronPort apppreciates the time it takes to submit false positives/negatives and that every one counts. Thanks! --Woody ... View more

Hi Philippe, Thanks! Your current TLS configuration actually looks good, using the ciphers you have listed is fine.  The IronPort does include quite a list of ciphers you can use, I counted 34 That being said, we do have some recommendations that we've published that will allow you to keep your cipher strengths in the medium/high strength category, and avoid using :ALL. The following Knowledge Base article describes a short string you can use in 'sslconfig' https://ironport.custhelp.com/app/answers/detail/a_id/1367 One thing we have to be concerned with when using TLS is that we include a cipher strength that the remote smtp server is going to be able to negotiate. As you know, picking just one cipher and ignoring all others would leave you in a position where plenty of TLS connections would fail due to non-negotiation. Going with the highest ciphers is more cpu intensive on the IronPort, but going with the lowest ciphers might not allow you to connect to some institutions that do not allow less than 128bit, for instance. The string shown in the KB article shows how we can: include medium and high cipher strengths, disable SSLv2 (which is becoming more commonplace due to some bugs found in SSL over the past years, but is certainly optional) and disallow anonymous ciphers.      Inbound SMTP method: sslv3tlsv1       Inbound SMTP ciphers: MEDIUM:HIGH:-SSLv2:-aNULL:@STRENGTH       Outbound SMTP method: sslv3tlsv1       Outbound SMTP ciphers: MEDIUM:HIGH:-SSLv2:-aNULL:@STRENGTH To me, this represents a happy medium, where we can feel safe that we're using strong ciphers to protect our information, but not excluding too many ciphers that might cause us to run into negotiation issues with remote servers. Hope that helps, --Woody ... View more

Hi Doug,      Thanks for the kind words. We do what we can    I'm glad to see you're getting a good, high stoppage percentage from the appliance. Drop percentages in the 90%+ range are typical in my experience. The config items you've provided seem fairly reasonable. Myself, being paranoid, I would probably extend the Unkownlist to +10 SBRS mark, and leave the Whitelist with an empty SBRS range, as it comes by default. Because everyone's mail flow is different ( my company will receive different targeted spam than yours, for instance ), obtaining the maximum potential can be as much an art as a science. Since we often are asked what extra steps can be taken to get the maximum potential out of your IronPort, we've published an external Knowledge Base article that lists *several* things you can do to stop as much spam as possible: https://ironport.custhelp.com/app/answers/detail/a_id/493 I cannot stress enough to use Step 11: Report mis-classified messages to IronPort.  Anytime you catch an email making it through our systems, we want to know. You cannot submit too many samples. (The same holds true for misclassifed HAM messages.) I'd go through the checklist on the url above and put into place as many as you feel you can. These recommendations should help you get those extra percentage points you're looking for. Hope that helps, --Woody ... View more

Hi Bob,      Good question. I'm assuming you'd like to block inbound messages from a particular sender. Message filters will use the least amount of resources to block an email. This is basically due to the fact that message filters affect the message very early in the process of evaluation. Policies and content filters occur later in the process, triggering more actions before they are reached, and therefore will use more resources. That being said, if you find yourself wanting to block several senders and find you are adding more and more individual message filters, you'd be counter-acting their advantage. Also, this can become unwieldly, as it's harder to manage than a list of "bad senders" which can be managed centrally. That's a situation where you would want to consider using a dictionary to store the list of sender addresses, where you can add and subtract them as needed in one central file. Cisco's Knowledge Base contains an existing article describing how to  do just that, and I encourage you to read it to see if it meets your  needs: https://supportops.sfo.ironport.com/kb/?cc=disp&id=5615 For examples and syntax of message filters, you can access the Cisco IronPort's online help from the appliance's web interface through the link: 'Help and Support -> Online Help' Use the Search box in the online help to search for 'message filters', then scroll down to the section 'Advanced Configuration Guide'. There are several sections dedicated to message filters. Hope that helps, --Woody ... View more

Hi David,    We'd be happy to help get your test boxes provisioned for the 7.6 release, if you'd like to test it out. Since we'll need your appliance serial numbers, it would be best for you to open a standard support request to keep your information confidential. Feel free to open a support request explaining that you'd like your test boxes be allowed to upgrade to 7.6. Include the serial numbers of the appliances in the request. Once the engineer processes your request, your appliances will automatically see the upgrade available via the 'upgrade' command in the CLI, or the upgrade page in the web interface. Since you mentioned these are test boxes, I will mention the requirement listed on Page 4 of the 7.6 release notes: http://www.cisco.com/en/US/docs/security/esa/esa7.6/ESA_7.6_Release_Notes.pdf "Starting in AsyncOS 7.6, an Email Security appliance requires an anti-spam system feature key in order to use the SenderBase Reputation Service." So, you'd want to keep that in mind that if your test boxes don't have current antispam keys, the SBRS system will not be available. All that being said, as I mentioned in a previous post, the limited release is the last step before General Availability. We do not post time-frames for the GA release, in the event that any last minute issues need addressing. But, the release should be available in the very near future. Sorry for being so vague.  Thanks, --Woody ... View more

Hi Greg, Directory Harvest Attacks, sometimes called 'dictionary attacks' are defined by the technique spammers use to try to determine valid email addresses on a mail domain. Many spammers send emails to a high number  of invalid addresses, so blocking senders who send to invalid  recipients can also decrease spam. Given that Directory Harvest Attack Prevention (DHAP) on the Cisco IronPort aborts the connection at the SMTP conversation phase, it is quite effective at preventing the attacker from reaching many valid usernames on your domain. As a general rule, DHAP attacks are short-lived burts of attempts to reach valid users. Given the nature of these attacks, and their (usual) brevity, I would recommend allowing the Cisco IronPort to handle the rejections for you. DHAP was designed to exclusively handle these types of attacks. Thanks, --Woody ... View more

Hi,      I've included my responses inline for easier reading: 1) Are SMTP TLS-Encryption and Cisco Ironport Email-Encryption are different ways to encrypt Mails ? 1A) Yes, they are different. SMTP TLS (Transport Layer Security )encryption is point-to-point encryption between to smtp servers when transmitting messages. This is to protect from others 'eavesdropping' on the connection and intercepting the communication in plain text. The communicating servers identify themselves using digital certificates. The client may contact the server that issued the certificate (the  trusted CA) and confirm the validity of the certificate before  proceeding. Cisco IronPort Email Encryption is a system which encrypts the message itself, using ARC4 or AES encryption. (ARC4 is the most common choice, it provides encryption with minimal decryption delays for message recipients.) The encrypted message can then be transmitted through a standard SMTP connection, or via TLS connection. The basic workflow for opening encrypted messages is: Step 1 When you configure an encryption profile, you specify the parameters for message  encryption. For an encrypted message, the Email Security appliance  creates and stores a message key on a local key server or on the hosted  key service (Cisco Registered Envelope Service). Step 2 The recipient opens the secure envelope in a browser. Step 3 When a recipient opens an encrypted message in a browser, a password may be required to authenticate the recipient’s identity. The key server returns the encryption key associated with the message. Note: When opening an encrypted email message for the first time, the recipient is  required to register with the key service to open the secure envelope.  After registering, the recipient may be able to open encrypted messages  without authenticating, depending on settings configured in the  encryption profile. The encryption profile may specify that a password  isn’t required, but certain features will be unavailable. Step 4 The decrypted message is displayed. 2) For Ironport Email-Encryption i need a Feature Keys for TLS-Encryption not is this correct ? 2A) Correct. A feature key is required for Cisco IronPort Email encryption. TLS is a standard mail transmission protocol and as such, is available for configuration within the appliance's settings. 3) How can i check in the Version 6.5.3 how long my certificate for TLS Encryption is valid ? 3A)  In version 6.5.3, the appliance uses one certificate for TLS and SSL ( browser security ), so the easiest way to check its expiration date is to connect to the Cisco IronPort's web interface, and use your browser to view the certificate the site uses. For instance, in my version of Firefox, I can click on the domain name beside the url bar, choose 'More Information -> View Certificate' and the certificate details are shown. This includes the expiration date of the certificate. Directions for retrieving a certificate's information through other browsers should be readily available on the Internet. You can also pull the certificate information from an openssl connection to your appliance and extract the expiration date. The following commands are generally available on a Linux/Unix box: Retrieve the certificate $ echo "" | openssl s_client -connect ironports_hostname:25 -starttls smtp > dump_certificate Retrieve then the expiration date of the certificate $ openssl x509 -in dump_certificate -noout -enddate It should give you an output similar to: notAfter=May  20 22:00:00 2019 GMT ( Substitute ironports_hostname for the hostname of your Cisco IronPort Email Security Appliance in the example.) Hope that helps. --Woody ... View more

The 7.6 build is currently in what can be considered a 'First Customer Ship' phase. It has not yet been released for install by all appliances, but is considered a stable release. These builds are released to specific customers who have aligned with Cisco to deploy the software before General Availability. The build is considered stable, but these early adopters offer a chance for any last minute issues to be addressed, should any be found. If, while running the 'upgrade' command, you see 7.6 as an option, upgrade at your leisure. For those who do not see this build available, take note that this is the final step before General Availibilty, which means 7.6 will be available in the near future. 7.6 is an exciting release, as it will be the first official ESA build with IPV6 support. Cisco's website contains the 7.6 release notes outlining what is new and what defects have been addressed: http://www.cisco.com/en/US/docs/security/esa/esa7.6/ESA_7.6_Release_Notes.pdf ... View more

Hello everyone, Feel free to fire away with questions you may have regarding the Cisco Email Security Appliance. I'm here to answer them to the best of my ability. --Woody ... View more

Best practices will vary widely according to your particular installation. Cisco IronPort has put together some guidelines that should be helpful, and posted them in the support portal. http://www.ironport.com/support/login.html If you login and search the KnowledgeBase for 'best practice', you'll be returned >60 documents regarding various portions of IronPort configuration. -whardison ... View more