Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Paul Thomas Cyblue
09-19-2019
Stats
Member since
10-26-2018
32
Posts
50
Helpful
2
Solutions
Created by
Paul Thomas Cyblue
in Cisco Bug Discussions
in Cisco Bug Discussions
09-12-2019
04:35 AM
09-12-2019
04:35 AM
Does anybody have some background on this issue / experienced this ? You couldn't make up the TAC response I had. Bug currently lists v12.0.0-419 / 12.5.0-066 " After doing a research" (you mean googled cisco bug fix site) "I found that there are not bugs reported for errors on syslog servers on v12.5.0-059, it means that if you upgrade and everything goes fine we can confirm that the version is good for syslog, if not, you will be the first case and we will need to attach that version on the bug file in order for us to fix it on a later time " Don't fancy being a guinea pig - where are unit tests in this 'agile' world nowadays. Thanks Paul
... View more
- Tags:
- syslog
Labels:
Created by
Paul Thomas Cyblue
in Email Security
in Email Security
07-05-2019
07:35 AM
07-05-2019
07:35 AM
That's fine, off the top of my head I thought it didn't add the extra slash in the GUI, but it does on checking. Plus I used the Trace command under System Administration to check that the Content filter matched. You didn't need to escape the @
... View more
Created by
Paul Thomas Cyblue
in Email Security
in Email Security
07-05-2019
01:30 AM
07-05-2019
01:30 AM
Use Regex101.com - below link contains your search and permutations https://regex101.com/r/73c37m/3/ Note that \. ensures that the domain separator dot is treated as a dot. Otherwise regex treats this as any character. This can be important at times. Note that there is a strange behavior where the CISCO ESA Message Filters created via SSH console require double escapes, whereas in the GUI (Content Filters / Dictionary) they do not. Message Filter - ^(?i)billing@delivery-.*\\.info$
... View more
Created by
Paul Thomas Cyblue
in Email Security
in Email Security
07-04-2019
11:15 AM
07-04-2019
11:15 AM
Not tested, but you could just replace the address in the rule with your personal email address to validate. Dictionary ^(?i)billing@delivery-.*\.info$ CLI Message Filter block_sender: if (mail-from == "^(?i)billing@delivery-.*\\.info$") { drop(); } Content Filter Sender > Equals > (?i)billing@delivery-.*\.info This will appear in list as ^(?i)billing@delivery-.*\\.info$
... View more
Created by
Paul Thomas Cyblue
in Email Security
in Email Security
07-03-2019
03:45 AM
07-03-2019
03:45 AM
On your Web Proxy, turn off certification verification for the CISCO Aggregator site. It uses a CISCO root cert that will not be in the Web Proxy trust store.
... View more
Created by
Paul Thomas Cyblue
in Email Security
in Email Security
07-03-2019
03:42 AM
07-03-2019
03:42 AM
We have all logs via Syslog TCP on very heavy servers. Including LDAP Debug and SMTP logs. Do not try UDP - that simply hides the issue and data loss. The problem is as it states, the receiver is not fast enough ( Rsyslog queues forming or not enough TCP threads or heavy logging server that needs another NIC etc.) There is no bug as such, just an enhancement to follow WSA capability. It would be good for a larger buffer in times of small outages - as even a Load-balancer takes a while to figure out a destination Syslog server is down.
... View more
07-03-2019
03:16 AM
Simple response - the URL Reputation Better response - split your Content Filter conditions into separate Content Filters. I may keep multiple Subject conditions together (but numerous would be done via a dictionary) due to relation to a specific topic / requirement. But wouldn't mix and match different types of conditions that potentially depend on different features. As you have found, you'll have to looked at matched content or view the actual email to try and manually figure out which condition caused this.
... View more
Created by
Paul Thomas Cyblue
in Email Security
in Email Security
07-03-2019
01:42 AM
07-03-2019
01:42 AM
I almost had time for one of those a few years ago. But I don't think it would ever had made it out of beta if I had.
... View more
Created by
Paul Thomas Cyblue
in Email Security
in Email Security
07-02-2019
09:41 AM
07-02-2019
09:41 AM
Graymail engine restarting due to Graymail Rules update. There is a 'manual' engine rollback feature - does not work - this is a rules update issue, not an engine update issue. We would like 2 engines available. Current engine version + Previous engine version The same for Rule Updates Current rule update + Previous rule update Should the system detect an engine restart 3 times, then the Engine + Rule Updates since the first detection are marked bad. If the engine has been update in the past 24hrs, use Previous Engine. Else, use Previous Rule Update to last known good (not marked bad update). As new Engine Updates or Rule Updates are received, send a copy of a message in pipeline through the Engine+Rule and discard. If successful 3 times, update Engine (if required) + Rule Update and mark both Engine + Rule Update good. ( 3 times - assuming historically any message killed the engine ) System reverted to a good state - automatically, without manual intervention.
... View more
Labels:
Created by
Paul Thomas Cyblue
in Email Security
in Email Security
06-21-2019
07:07 AM
06-21-2019
07:07 AM
It's been a while using an internal or odd-ball public cert, but maybe the question should be - does the SMA have any Trust store / perform any validation. I generally configure the cert and inter via certconfig. Not the root. This has been for internal and public certs. On the ESAs, I add custom internal roots into its Trust store, but no roots on the SMAs. Never thought about it, so would guess the SMA is not bothered.
... View more
06-21-2019
06:56 AM
That is correct. Write to file - file timestamp cannot be used for all log entries, so each line receives a timestamp and msg content Stream via Syslog - timestamp and msg added to the relevant syslog protocol properties and parsed by the receiving syslog server. Their problem was they used UDP which simply hid the lost packet issues - likely Rsyslog could not keep up with volume and needed some queue tuning. Changing to TCP will generate alerts by the ESA if the syslog server isn't capable of receiving traffic fast enough.
... View more
Created by
Paul Thomas Cyblue
in Email Security
in Email Security
06-21-2019
06:32 AM
06-21-2019
06:32 AM
I don't use Virtual appliances to test on. I assume you are trying to get to machine mode... create command file clustermode 3 <blank line here as taking default> showlicense ( the carriage returns will be sending the command and the blank line to inherit the default, which will be current machine you are logged onto ) Create script file set hh=%time:~0,2% if "%time:~0,1%"==" " set hh=0%hh:~1,1% set dt=%date:~-4,4%%date:~-7,2%%date:~-10,2%_%hh%%time:~3,2%%time:~6,2% start echo y | plink -i "<path to ppk" <username>@<hostname> -m "<path to command file" > "path to log_%dt%.log" 2>&1 Or use Expect if available, or try to manipulate the above to work in your processes. Thanks Paul
... View more
Created by
Paul Thomas Cyblue
in Email Security
in Email Security
04-25-2019
01:54 AM
04-25-2019
01:54 AM
Going to v11 we noticed a step change in CPU and thus more workqueues on burst traffic. So assess how much under load and consider your DR strategy. Just make sure you read the Release Notes + search the Bug lists for that version and around it, to assess if any bug is using a specific feature that is something you depend on. I had to discount certain versions and could ignore certain bugs to end up where we are. There is no straight answer. But this required an upgrade to the SMAs and this is where the problems have been. SMAs under heavy load or using all Message Tracking Quota - then v11.5 + v12 for SMA are having considerable stability problems with bad workarounds. This looks like a fix in SMA v13 and ESA v12 - which will need their own time to bed in to find other issues.
... View more
04-25-2019
01:42 AM
Just keep it simple. You know the sender of Delivery Failures is null You know the recipient as that was the original Envelope From Create a Policy for the Recipient Create a Content Filter with Condition Envelope Sender Contains ^$ (Delivery Failures, Out of Office) Action - Drop ( or quarantine to start with ) Apply the Content Filter to the Policy Reuse the Content Filter on other Policies where some accounts want to be protected from Delivery Failure messages.
... View more
04-25-2019
01:35 AM
You have turned off TLSv1.0 - first turn this back on. You need to perform an analysis of traffic before turning this off. Working with the critical business partners still using this. A good check against your system is using checktls.com using SSL Probe option I believe the below cipher string is from a 'recommendation' - but who is recommending I say. You need to balance support v security, that is why the big providers provide so much backwards compatibility to low encryption levels, as they don't want to turn business away. EDH+TLSv1.2:EDH+HIGH:HIGH:!MEDIUM:!ECDH:!ECDSA:!LOW:!EXP:!aNULL:!DSS:!IDEA:!PSK:!3DES:!SRP:@STRENGTH:!EXPORT:-aNULL:-EXPORT Analyse the traffic, when low enough, on v11+ then turn off TLSv1.0 + tune weaker ciphers from the above cipher string. A good time to reassess tuning is when upgrading to the next ESA version.
... View more
09-12-2019
Does anybody have some background on this issue / experienced this ? You
couldn't make up the TAC re...
Created by
Paul Thomas Cyblue
in Email Security
07-05-2019
07-05-2019
That's fine, off the top of my head I thought it didn't add the extra
slash in the GUI, but it does ...
Created by
Paul Thomas Cyblue
in Email Security
07-05-2019
07-05-2019
Use Regex101.com - below link contains your search and
permutationshttps://regex101.com/r/73c37m/3/N...
Created by
Paul Thomas Cyblue
in Email Security
07-04-2019
07-04-2019
Not tested, but you could just replace the address in the rule with your
personal email address to
v...
Created by
Paul Thomas Cyblue
in Email Security
07-03-2019
07-03-2019
On your Web Proxy, turn off certification verification for the CISCO
Aggregator site.It uses a CISCO...
07-03-2019
We have all logs via Syslog TCP on very heavy servers. Including LDAP
Debug and SMTP logs.Do not try...
07-03-2019
Simple response - the URL ReputationBetter response - split your Content
Filter conditions into sepa...
Created by
Paul Thomas Cyblue
in Email Security
07-03-2019
07-03-2019
I almost had time for one of those a few years ago.But I don't think it
would ever had made it out o...
Created by
Paul Thomas Cyblue
in Email Security
07-02-2019
07-02-2019
Graymail engine restarting due to Graymail Rules update.There is a
'manual' engine rollback feature ...
06-21-2019
It's been a while using an internal or odd-ball public cert, but maybe
the question should be- does ...
06-21-2019
That is correct.Write to file - file timestamp cannot be used for all
log entries, so each line rece...
Created by
Paul Thomas Cyblue
in Email Security
06-21-2019
06-21-2019
I don't use Virtual appliances to test on.I assume you are trying to get
to machine mode...create co...
Created by
Paul Thomas Cyblue
in Email Security
04-25-2019
04-25-2019
Going to v11 we noticed a step change in CPU and thus more workqueues on
burst traffic. So assess ho...
04-25-2019
Just keep it simple.You know the sender of Delivery Failures is nullYou
know the recipient as that w...
Public Statistics
| Date Registered | 10-26-2018 02:00 AM |
| Date Last Visited | 09-19-2019 02:50 AM |
| Total Messages Posted | 32 |
| Total Helpful Votes Received | 50 |
Helpful Votes From
