Just join the cluster from the second machine CLI > clusterconfig > join over ssh/ccs "based on how you configured things" and after the join the settings should be inhered from the cluster Regards Raed ... View more

Check the following article it might be of use  ESA Centralizing Policy, Virus, and Outbreak Quarantine (PVO) Cannot be Enabled Regards Raed ... View more

Hi Clement Most likely there is an override between the machine/cluster level for the Policy, Virus and Outbreak quarantine(PVO)  From the CLI run the following command clustercheck Regards Raed ... View more

Hi  Regarding your question the logs will be send to the syslog server. if you want to keep a copy of these logs on your appliance then just create another copy of these logs with an open of manual download. so for example create to two mail_logs of type I ronPort Text Mail Logs mail_logs_local with a manual download option "local logging on the machine" and mail_logs_syslog with syslog configured on it "external logging". Regards Raed ... View more

it doesn't work via the content filters "GUI", since the condition  attachment-binary-contains doesn't exist in them. Regards Raed  ... View more

Hi John, You can implement the following message filter: "you said that you want to block send as outgoing emails, in case you want to drop these emails then you can remove the first condition and the filter will take effect on all traffic; outgoing and incoming. also if you are going to implement the filter i would suggest using a   quarantine("Policy"); action instead of the drop(); action at first to test the filter around and see how it behaves after that "making sure you are not having FP issues" you can change the action to drop(); the more aggressive one or you can use an action as drop-attachments-by-size(0) which should drop the attachment only and not the hole email ". iIf (sendergroup != "RELAYLIST") { if ( (attachment-filename == "(?i)\\.(xls|doc|ppt|xlsx|docx|pptx|docm|dotm|xlsm|xltm|xlam|pptm|potm|ppam|ppsm|sldm)$") AND (attachment-binary-contains("(?i)x-vba-macros")) OR (attachment-binary-contains("[Vv][Bb][Aa]")) AND(attachment-binary-contains("(?i)versioncompatible32") ) ) { log-entry("MacroFilter took effect"); drop(); } } . the filter should check if the sender-group is matching relaylist "outgoing emails" (or this condition can be replaced with recv-listener=="OutgoingEmails"; in case you have multiple listener for incoming/outgoing traffic) and then test the rest of the conditions. "also you can edit the filter to include more extensions in case i forgot some"  Regards Raed ... View more

Hi Sandy, Give the following articles a read, they have multiple methods to deal with spoofing emails, hope they help! ESA Spoofed Mail Filtering Spoof Protection using Sender Verification ESA SMTP Authentication Condition to Prevent Spoofing Quarantine Spoofed Email Messages on the ESA and Create Exceptions For Senders That Are Allowed To Spoof Regards, Raed ... View more

Hi irsahd, You should be able to search for the Subject as it is from the message tracking or grep the mail_logs from the CLI. And from there you can get all the information you are looking for. Regards Raed ... View more

No worries ... View more

Hi Cristian, Check the following BUG OpenSSL -- TLS 1.1, 1.2 denial of service vulnerability  CVE-2012-4929 is assigned with it, and the BUG report says that 8.0.1-023 is a Known Fixed Release, so newer GD releases shouldn't have this issue too. Regards Raed ... View more

Hi, Just implement the following incoming content filter and assign it to the incoming mail policy in question: Condition > attachment-filetype == "Executable"  Action > Quarantine("Policy") [You can change this into drop after testing the filter and seeing how it performs] The reason for this is the fact that the filter will do body-scanned for .zip files and .rar files, which means that the filter will check .zip files and .rar files for excusable "condition" and take actions based on the filter "Quarantine in this case". Ref: AsyncOS version 9.7.1 user guide page 212 Note about your filter, from the drop down list next to conditions are you using If one or more conditions match "aka OR" or Only if all conditions match "aka AND". Regards Raed ... View more