User Guide for AsyncOS 13.5.1 for Cisco Email Security Appliances - GD (General Deployment)

Contents

$ - < - A - B - C - D - E - F - G - H - I - K - L - M - N - O - P - Q - R - S - T - U - V - W - X

Index

$

$EnvelopeSender variable 1

$TRUSTED mail flow policy 1

<

< 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

A

accepting email 1

access privileges for custom user roles 1

Active Directory Wizard 1

Adaptive Scanning 1

address rewriting 1

address tagging key

purging 1

Advanced Malware Protection 1

alert messages 1 2

alert settings 1 2

alertlisting 1

alerts

enabling for Outbreak Filters 1

severities 1

ALL entry

in HAT 1 2

in RAT 1

ALLOWED_LIST sender group 1

alternate address 1

always rule 1

AMP Archive 1

AMP Engine Logs 1

AMP. See Advanced Malware Protection. 1

anti-spam

HAT parameter 1

IronPort Anti-Spam 1

reporting false positives and negatives 1

scanning appliance-generated messages 1

selecting a default scanning engine 1

testing 1

using multiple scanning engines 1

Anti-Spam Archive Logs 1

Anti-spam logs 1

anti-virus 1

actions 1

add custom header 1

advanced options 1

archive original message 1

dropping attachments 1

Encrypted 1 2

modify message recipient 1

modify message subject 1

scan and repair 1

scan only 1

send custom alert notification 1

send to alternate destination host 1

sending default notification 1

Unscannable 1

Virus Infected 1

Anti-Virus Archive Logs 1

Anti-Virus Logs 1

anti-virus quarantine. See quarantine, virus 1

archivemessage command 1

AsyncOS reversion 1

AsyncOS upgrades 1

AutoSupport feature 1 2 3

B

Base DN 1

blackhole listener 1 2

body scanning 1

Bounce Logs 1

bouncerecipients command 1

bouncing recipients

all 1

by Envelope From 1

by hostname 1

bypassing

anti-spam 1

throttling 1

C

call-ahead SMTP server 1

routing 1

CASE (Context Adaptive Scanning Engine [TM]) 1

case-sensitivity

in LDAP queries 1 2

in message filters 1

categories

adult 1

advertisements 1

alcohol 1

arts 1

astrology 1

auctions 1

business and industry 1

chat and instant messaging 1

cheating and plagiarism 1

child abuse content 1

computer security 1

computers and internet 1

dating 1

digital postcards 1

dining and drinking 1

dynamic and residential 1

education 1

entertainment 1

extreme 1

fashion 1

file transfer services 1

filter avoidance 1

finance 1

freeware and shareware 1

gambling 1

games 1

government and law 1

hacking 1

hate speech 1

health and nutrition 1

humor 1

illegal activities 1

illegal downloads 1

illegal drugs 1

infrastructure and content delivery networks 1

internet telephony 1

job search 1

lingerie and swimsuits 1

lotteries 1

mobile phones 1

nature 1

news 1

non-governmental organizations 1

non-sexual nudity 1

online communities 1

online storage and backup 1

online trading 1

organizational email 1

parked domains 1

peer file transfer 1

personal sites 1

photo searches and images 1

politics 1

pornography 1

professional networking 1

real estate 1

reference 1

religion 1

SaaS and B2B 1

safe for kids 1

science and technology 1

search engines and portals 1

sex education 1

shopping 1

social networking 1

social science 1

society and culture 1

software updates 1

sports and recreation 1

streaming audio 1

streaming video 1

tobacco 1

transportation 1

travel 1

unclassified 1

weapons 1

web hosting 1

web page translation 1

web-based email 1

centralized management 1

Centralized Management

and Destination Controls 1

and quarantines 1

certificate

certificate authority 1

Certificate Signing Request 1

certificates

demo 1

generating a request 1

generating and signing your own 1

importing 1

intermediate certificates 1

chain query

creating 1

charset 1

CIDR address block 1

Cisco Security Intelligence Operations 1

Cisco Web Security Services 1

clean messageemail

clean message 1

CLI

see Command Line Interface 1

CLI Audit Logs 1

cluster 1

Code-in-Body> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

community string 1

conformance level

SPF/SIDF verification 1

connectivity issues, troubleshooting 1

content filters 1

actions 1

conditions 1

example 1 2 3

non-ascii character sets 1 2

variables 1

content matching classifier 1

Content Scanner 1

counters 1

CPU usage 1

CRAM-MD5 1

CSV data 1

custom header 1

custom SMTP response

variable 1

D

D-Mode 1

data loss prevention 1

default

domain 1

gateway 1 2

hostname 1 2

IP address 1

router 1 2

default DNS server 1

default router 1

delete all messages in the spam quarantine 1

deleterecipients command 1

delivering mail

message time out 1

possible delivery 1

delivernow command 1 2

Delivery Connection ID (DCID) 1

Delivery Logs 1

delivery queue 1

delivery queue, monitoring 1

demo certificate 1

Destination Controls

and Centralized Management 1

detection rule 1 2

Direct Server Return (DSR) 1

Directory Harvest Attack (DHA) 1

disclaimer stamping 1 2

multiple encodings 1

disclaimers

adding to messages 1

HTML text resources 1

using text resources 1

DKIM verification 1

Authentication-Results header 1

DLP

false positives, minimizing 1 2 3 4 5

including sensitive content in Message Tracking 1

risk factor score 1

severity scale 1

troubleshooting 1

updating the engine and classifiers 1

DLP policies

content matching classifier 1

detection rule 1 2

filtering attachments 1

filtering senders and recipients 1

DNS

authoritative server 1

disabling reverse DNS lookup timeoutReverse DNS Lookup

disabling 1

double lookup 1

priority 1

servers 1 2

setting 1 2

splitting 1

timeout 1

timeout for reverse DNS lookups 1

DNS cache 1

DNS list 1

DNS lookup 1

DNS servers 1

DNSBL 1

dnsstatus command 1

Domain Debug Logs 1

Domain Keys 1

importing signing keys 1

signing key size 1

verification 1

verifying signatures 1

Domain Name Service (DNS)

settings 1 2

domain profile

deleting all existing profiles 1

double-DNS verified 1

drop-attachments-where-dictionary-match 1

DSR 1

load balancing 1

loopback interface 1

Virtual IP (VIP) 1

DTD (document type definition) 1

dual DKIM and DomainKey signing 1

dummy accounts 1

duplex settings, editing 1

E

Early Expiration

for quarantine 1

email

rewriting addresses 1

email injector

see listener 1

Email Security Monitor 1

automated reporting 1

external domains received listing 1

Items Displayed menu 1

summary table 1

Time Range menu 1

encoding

in disclaimers 1

encryption 1 2

use with filter action 1 2

encryption headers 1

End User Quarantine

see spam quarantine, end user access 1

enterprise gateway 1

Enterprise Gateway configuration 1

Envelope Recipient 1

Envelope Recipient, rewriting 1

Envelope Sender 1

envelope sender DNS verification 1

evaluation key

McAfee 1

Sophos 1

evaluation key for IronPort Anti-Spam 1

evaluation key for Outbreak Filters 1 2

explained 1

exporting

HTML text resources 1

text resources 1

external authentication 1

enabling LDAP 1

enabling RADIUS 1

F

factory configuration 1

feeback about this documentation, sending 1

filtering unparsable messages 1

filters 1

comment character 1

matching dictionary terms 1 2

matching empty headers 1

regular express and Python 1

scannable archive file types 1

unparsable messages 1

final entry, in HAT 1

findevent 1

finding senders 1

forcing updates 1

forward DNS lookup 1

FTP 1

FTP Access 1

FTP Server Logs 1

fully-qualified domain name 1

G

gauges 1

global counters 1

good neightbor table 1

graphical user interface

see GUI 1

graphs 1

grouping, of appliances for File Analysis result details in the cloud 1

GUI

accessing 1

browser requirements 1

enabling 1 2

GUI logs. See HTTP logs 1

GUI session timeout 1 2

H

hard power reset 1 2

HAT 1

exporting 1

testing HAT variables 1

HAT order

editing via GUI 1

headers 1

headers, inserting 1

headers, logging 1

headers, stripping with message filters 1

Host Access Table (HAT)

reordering in GUI 1

hostname 1 2

specifying the hostname during setup 1

hostrate command 1

hoststatus command 1

HTTP 1

enabling 1

GUI 1

HTTP authentication 1

HTTP Logs 1

HTTPS 1

certificate for 1

enabling 1

GUI 1

HTTPS login 1

I

image analysis 1 2 3

image scanning 1

image verdicts 1

IMAP authentication 1

implementsv 1

importing

HTML text resources 1

text resources 1

importing signing keys 1

incoming relay

custom header 1

received header 1

incoming relays 1

Incoming Relays

example log entry 1

Injection Connection ID (ICID) 1

injection control counter reset 1

injection control periodicity 1

Injection Debug Logs 1

injector

see listener 1

insecure relay 1

inserting headers 1

installation

reverting 1

invalid recipient 1

IP interfaces

assigning 1

defining listeners on 1

IronPort Anti-Spam

evaluation key 1 2

filters 1

testing 1

IronPort Email Encryption

configuring 1

envelope settings 1

key server settings 1

message settings 1

notification settings 1

use with filter action 1 2

IronPort Spam Quarantine

released messages and email pipeline 1

IronPort Spam Quarantine. See Spam quarantine 1

IronPort Text Mail Logs 1

K

key size 1

L

LDAP 1 2

alias consolidation query 1

alias expansion 1

anonymous queries 1

base DN 1

connection pooling 1

connections 1

external authentication 1 2

failover 1

group queries 1 2

LDAPS certificate 1

load-balancing 1

Microsoft Exchange 5.5 support 1

multiple servers 1

OpenLDAP queries 1

query tokens 1

recursive queries 1

SSL 1

SunONE queries 1

test servers 1

testing queries 1 2

testing servers 1

LDAP Debug Logs 1

LDAP errors 1

LDAP routing query

with SMTP call-ahead recipient validation 1

LDAPS certificate 1

limits

SMTP Routes 1

link aggregation 1

listener

adding disclaimers 1

encryption on 1

malformed MAIL FROM and default domain 1

listenerconfig command 1

load 1

log file type 1

log subscription 1

Sophos 1

log subscriptions 1

logging,headers 1

logical IP interface 1

logs

Anti-Spam Archive 1

Anti-Virus 1

Anti-Virus Archive 1

Bounce Logs 1

CLI Audit Logs 1

comparison 1

Configuration History Logs 1

definition 1

Delivery Logs 1

extensions in filenames 1

format 1

FTP Server Logs 1

global attributes 1

HTTP Logs 1

Injection Debug Logs 1

IronPort Text Mail Logs 1

LDAP Debug Logs 1

levels 1

log subscription defined 1

NTP Logs 1

qmail Format Delivery Logs 1

Scanning 1

Status Logs 1

subscriptions 1

troubleshooting with 1

loopback interface 1

M

M-Series 1

MAIL FROM 1 2

mail loops, detecting 1

mail policies

First Match Wins 1

mail policies, outgoing

DLP 1

mail protocol

defining in < 1

mail transfer agent. See MTA. 1

mailertable feature 1

mailing lists

notifications 1

malware

defined 1

marketing messages 1

matching empty headers 1

maximum

message size in HAT 1

messages per connection in HAT 1

recipients per hour in HAT 1

recipients per message in HAT 1

maximum recipients per hour 1

mbox format 1

mbox-format log file 1

McAfee

evaluation key 1

McAfee anti-virus engine 1

memory 1

message body scanning 1

message encoding

modifying 1

message filter

filter actions 1

message filter action variables

using in disclaimers 1

message filter for SBRS 1

message filters 1

adding 1

attachment-protected 1

attachment-unprotected 1

body-dictionary-match 1

combining 1 2

deleting 1

encryption 1

exporting 1

importing 1

making (in)active 1

MIME types 1

moving 1

ordering 1

overview 1

random numbers in 1

rules 1

SenderBase Reputation Score 1

status 1

syntax 1

time and date 1

variables 1

message headers 1

message headers, inserting with message filters 1

Message ID (MID) 1

message modification level threshold 1

message replication 1 2

message splintering

defined 1

message tracking

Incoming Relays 1

Message Tracking

and sensitive content 1

message variables

spam quarantine notifications 1

MIB file 1

monitoring 1

monitoring Virtual Gateway addresses 1

MTA 1 2 3

multilayer anti-virus scanning 1

multiple appliances 1

multiple recipients 1

MX 1

N

negative scores 1

netmask 1

network access list 1

network time protocol (NTP)

settings 1 2

NIC pairing 1

alerts 1

named on upgrade 1

NIC teaming 1

Normal Expiration

for quarantine 1

not.double.verified 1

NTP Logs 1

NTP server

removing 1

NXDOMAIN 1 2

O

oldmessage command 1

open relay, definition 1

opening links in a separate window 1

Outbreak Filters

Adaptive rules defined 1

Adaptive Scanning 1

alerts 1

always rule 1

anti-virus updates 1

bypassed file extensions 1

Context Adaptive Scanning EngineOutbreak Filters

CASE 1

delaying messages 1

enabling alerts 1

evaluation key 1 2

modifying messagesOutbreak Filters

message modification 1

multiple scores 1

non-viral threats 1

Outbreak rules defined 1

overview 1

re-evaluating messages 1 2

redirecting links 1

rule 1

setting a message modification level threshold 1

setting a quarantine level threshold 1

skipping 1

SNMP Traps 1

threat categoriesOutbreak Filters

virus outbreaks 1

updating rules 1

using without anti-virus scanning 1

overflow 1

P

partial address

in HAT 1

in RAT 1

passphrase

settings 1

pausing the work queue 1

PEM format, for certificates 1

performance 1

phased approach to reputation filters 1

pinout for serial connection 1

POP authentication 1

POP/IMAP servers 1

positive scores 1

possible delivery 1

private injector 1

private key 1

private listeners

default entries 1

prototcol

see mail protocol 1

proxy server for IronPort Anti-Spam Rules 1

public blocked list 1

public listeners

default entries 1

purging address tagging keys 1

PVO. See quarantines, policy, virus, and outbreak 1

Q

qmail Format Delivery Logs 1

quarantine 1

applying actions to messages in 1

default action 1 2

displaying non-ascii characters in subject 1

early expiration 1

In other quarantines 1

international character sets 1

normal expiration 1

outbreak 1

outbreak, reporting messages to Cisco 1

retention time 1

spam. See Spam quarantine 1

stripping attachments 1

subject tagging 1

testing messages for viruses 1

unclassified 1

virus 1

quarantine level threshold 1

quarantine overflow 1

Quarantine Threat Level Threshold

recommended default 1

setting 1

quarantines

centralized policy, virus, and outbreak quarantines 1

policy 1

policy, virus, and outbreak

centralized 1

policy, virus, and outbreak, managing 1

types 1

queries

acceptance 1

external authentication 1

group 1

masquerading 1

routing 1

SMTP authentication 1

spam quarantine alias consolidation 1

queue 1

R

RADIUS external authentication 1

RAM 1

RAM Utilization 1

RAT

bypassing recipients 1

bypassing recipients (CLI) 1

bypassing recipients (GUI) 1

rate command 1

rates 1

RBL 1

RCPT TO 1 2

RCPT TO command 1

real-time monitoring 1

received header 1

receiving control, bypass 1

receiving errors 1

Recipient Access Table (RAT)

default entry 1

definition 1

editing via CLI 1

recipient validation 1

recipients, counting in message filters 1

reconfigure 1

recursive DNS queries 1

recursive queries, LDAP 1

redirecting email 1

redirecting URLs in messages 1

redirectrecipients 1

relaying email 1

relaying messages 1

remote 1

removemessage command 1

reporting

Incoming Relays 1

required TLS 1

resetcounters command 1

Resource Conservation mode 1 2

resume command 1

resumedel command 1

resumelistener command 1

resuming email delivery 1

resuming receiving 1

Retention Time

for quarantines 1

retrospective verdict 1

retry message delivery 1

reverse DNS lookup 1 2 3

revert

installation 1

rewriting email addresses 1

rewriting URLs in messages 1

RFC

1065 1

1066 1

1067 1

1213 1

1907 1

2047 1

2487 1

2821 1

821 1

822 1

risk factor score 1

DLP 1

rolling over log files 1

root servers (DNS) 1 2

routing

SMTP call-ahead server 1

S

safelist/blocklist

and external spam quarantine 1

backing up and restoring 1

enabling 1

importing and exporting 1

managing 1

troubleshooting 1

workqueue 1

SBRS

none 1 2

testing 1

SBRS see Senderbase Reputation Service Score 1

scannable archive file types 1

scanning images 1

Scanning Logs 1

scheduled log rollover 1

scp command 1

SDS. See Cisco Web Security Services 1

secure copy 1

secure HTTP (https) 1

Secure LDAP 1

Secure Socket Layer (SSL) 1

selecting a notification 1

SenderBase 1

SBO in sender groups 1

SenderBase Affiliate network 1

SenderBase Network Owner Identification Number 1

SenderBase Reputation score 1

SenderBase Reputation Score 1 2

SenderBase Reputation Scores, syntax in CLI 1

SenderBase Reputation Service 1 2

SenderBase Reputation Service Score 1

SenderBase, querying 1

separate window icon 1

serial connection pinouts 1

SERVFAIL 1 2

severity scale

DLP 1

showmessage command 1

showrecipients 1

SIDF records

testing 1

valid 1

SIDF verification 1

configuring 1

conformance level 1

enabling 1

results 1

testing 1

signing key

size 1

signing keys

deleting all existing keys 1

removing specific keys 1

SMI file 1

SMTP

messages 1

response 1

testing IronPort Anti-Spam 1

SMTP Auth

DIGEST-MD5 1

MD5 1

SHA 1

suported authentication mechanisms 1

TLS 1

SMTP authenticated user match filter rule 1

SMTP Authentication profile 1

SMTP call-ahead recipient validation 1

bypassing 1

conversation workflow 1

SMTP server responses 1

with LDAP routing query 1

SMTP CAll-Ahead Server Profile

creating 1

enabling on a listener 1

SMTP conversation

SMTP call-ahead server 1

SMTP daemon

see injector 1

see listener 1

SMTP Routes 1

limits 1

mail delivery and splintering 1

SNMP

community string 1

MIB file 1

overview 1

SMI file 1

specifying multiple trap targets 1

traps 1

SNMP (Simple Network Management Protocol) 1

snmpconfig command 1

SNMPv1 1

SNMPv2 1

Sophos

evaluation key 1 2

updates 1

Sophos virus scanning

filters 1

spam

testing 1

spam message 1

spam quarantine

alias consolidation 1

behavior when full 1

deleting all messages 1 2

disabling 1

end user access 1

end-user access 1

external 1 2

IMAP/POP authentication 1

LDAP authentication 1

local 1

message details 1

message variables 1

notification 1

receiving multiple notifications 1

released messages and email pipeline 1

testing notifications 1

specifying an offset 1

SPF records

testing 1

valid 1

SPF verification

configuring 1

conformance level 1

enabling 1

received SPF header 1

results 1

testing 1

spf-passed filter rule 1 2

spf-status filter rule 1 2

SPFverification 1

SSH 1

SSL 1

STARTTLS

definition 1

stateless logs 1

status command 1

status detail command 1

Status Logs 1

stopped by content filter 1

stopped by reputation filtering 1

streaming upgrades 1

strip headers 1

strip-header filter action 1

subnet 1

suspenddel command 1

suspending email delivery 1

suspending receiving 1

suspendlistener command 1

synchronizing time 1 2

System Capacity

All page 1

Incoming Mail page 1

memory page swapping 1

Outgoing Mail page 1

System Load page 1

WorkQueue page 1

system clock 1 2

System Logs 1

system quarantine. See quarantines, policy, virus, and outbreak 1

system setup wizard 1

system time

setting 1 2

T

testing

IronPort Anti-Spam 1

Sophos virus engine 1

testing HAT variables 1

text resources

code view 1

disclaimers 1

exporting 1

exporting and importing into HTML resources 1

HTML-based 1

importing 1

managing 1

using in policies and settings 1

third-party relay 1

Threat Level

defined 1

Threat Operations Center (TOC) 1

thresholds, in SenderBase Reputation Scores 1

throttling 1

time servers 1 2

time zone 1

time zone, setting 1 2

time, system 1 2

TLS

certificates 1

default 1

preferred 1

required 1

tophosts command 1

topin command 1

trace 1

trace command 1

troubleshooting

DLP 1

trustworthiness 1

TTL 1

U

unary form, in message filters 1

unclassified quarantine. See quarantine, unclassified 1

unparsable messages 1

unsolicited commercial email 1

updates

DLP engine and classifiers 1

upgrades 1

available 1

local 1

obtaining via GUI 1

streaming 1 2

URL reputation 1

user accounts 1

limits 1

locking and unlocking 1

user groups 1 2

user types 1

uuencoded attachments 1

V

verdict

image analysis 1 2

verification

SIDF 1

SPF 1

version 1

virtual appliance

license 1

virtual Email Security appliance

loading the license 1

Virtual Gateway addresses 1

Virtual Gateway queue 1

Virtual IP (VIP) 1

virus message 1

virus quarantine. See quarantine

virus. 1

VLAN

defined 1

labels 1

W

WBRS

See URL reputation 1

web interface

enabling 1

web reputation

message filters 1 2

Web UI session timeout 1 2

weekly status updates 1

white space 1

whitespace 1

wizard

Active Directory 1

system setup 1

work queue 1 2

work queue, pausing 1

X

X-headers, adding 1

X-IronPort-AV header 1

XML 1 2 3

XML Status feature 1