Getting Started with Cisco Secure Email Gateway

This chapter contains the following sections:

What's New in AsyncOS 16.5

Table 1. Whats New in AsyncOS 16.5

Feature

Description

SNMPv3 Username Configuration Enhancement

SNMPv3 configuration now includes CLI prompts to set or update usernames for SNMPv3 requests and traps.

This enhancement allows you to explicitly configure the SNMPv3 username during the snmpconfig setup workflow, improving ease of configuration and serviceability.

OpenShift Virtualization Support

This release introduces OpenShift Virtualization, enabling users to create and manage virtual machines within the OpenShift environment.

You can create virtual machines using either form-based or YAML-based workflows from the web console, providing both guided and declarative configuration options.

The release supports volume creation through both URL and upload methods, allowing users to import images from a remote location or upload local image files during virtual machine provisioning.

Instance types and preferences are supported to standardize CPU and memory configurations, ensuring consistent and efficient virtual machine deployments.

These capabilities enable seamless management of virtual machines alongside container workloads on a unified platform.

For more information, see Cisco Secure Email Virtual Gateway and Secure Email and Web Manager Virtual Appliance Installation Guide.

Enhanced Update Failure Alert Emails

You receive alert emails from the Secure Email Gateway when an application fails to update after three consecutive attempts. These failures are caused by network configuration issues or temporary service outages.

These emails provide a direct link to a specialized Tech Zone article that provides information required to resolve the issue.

IPv6 Support for FTP and DANE

FTP access to the Email Security Gateway is supported over IPv6 when configured.

DANE support is also extended to IPv6 for email communications. Administrators can enable DANE support for IPv6 in mail policies under Destination Controls by selecting the appropriate TLS and DANE settings (for example, Opportunistic or Mandatory).

HTML Support for Bounce and Encryption Failure, and DLP Notification Templates in Text Resources

You can now create and edit notification templates using HTML formatting, in addition to plain text. This enhancement applies to the following notifications:

  • Bounce and Encryption Failure Notification

  • DLP Notification Template

This enhancement is available through both the GUI and CLI.

From the CLI, you can use the textconfig command to configure the HTML and plain text versions of these templates
Authenticated Received Chain (ARC) Support From the AsyncOS 16.5 release onwards, the Cisco Secure Email Gateway supports the Authenticated Received Chain (ARC) protocol.

ARC is a feature that provides a verifiable "chain of trust" for email authentication.It allows the Cisco Secure Email Gateway to preserve and verify the original authentication results of a message, even if it is modified by an intermediary like a mailing list or a forwarding service. This helps prevent legitimate emails from being incorrectly flagged as spam or rejected due to DMARC failures.

For more information, see Authenticated Received Chain (ARC)

Deleting ETF Records through CLI

From AsyncOS 16.5 release onwards, you can delete External Threat Feeds (ETF) records from the External Threat Feeds (ETF) database using deleterecord command in the CLI under threatfeedsconfig > sourceconfig.

Enhanced URL threat protection with Remote Browser Isolation (RBI)

Secure Email Gateway now supports Remote Browser Isolation (RBI) for handling potentially malicious URLs in email messages.

With RBI, URLs identified as suspicious are rewritten to open in an isolated remote browser environment instead of the recipient's local browser. The remote session allows you to safely view and interact with pages even if they contain unsafe or malicious elements.

For more information, see Modifying URLs in Messages: Using URL Reputation and URL Category Actions in Filters

Deprecation of TLS v1.0 and v1.1 in AsyncOS for Secure Email Gateway

From the AsynOS 16.5 release onwards, TLS v1.0 and TLS v1.1 are removed from CLI and GUI for the following configuration options:

  • GUI HTTPS

  • Inbound SMTP

  • Outbound SMTP

  • Other TLS Client Services

From version 16.5 onwards, users cannot configure Other Client Services. TLS v1.2 is enabled by default.

Ensure that all remote hosts connected to your appliance support TLS v1.2 to maintain uninterrupted service.

HTTPS Enabled by Default for AsyncOS API and Trailblazer Services

From AsyncOS version 16.5 onwards, the new web interface of Cisco Secure Email Gateway uses the AsyncOS API HTTPS port (6443) and the Trailblazer HTTPS port (4431) by default. The AsyncOS API HTTP port (6080) and the Trailblazer HTTP port (801) are disabled by default but can be manually enabled if required.

Comparison of Web Interfaces, New Web Interface with Legacy Web Interface

The following table shows the comparison of the new web interface with the legacy interface:

Table 2. Comparison of New Web Interface with legacy interface

Web Interface Page or Element

New Web Interface

Legacy Web Interface

Landing Page

 After you log in to the email gateway, the Mail Flow Summary page is displayed. After you log in to the email gateway, the My Dashboard page is displayed.

Reports Drop-down

 You can view reports for your email gateways from the Reports drop-down. You can view reports for your email gateway from the Monitor menu.

My Reports Page

 Choose My Reports from the Reports drop-down. You can view the My Reports page from Monitor > My Dashboard.

Mail Flow Summary Page

The Mail Flow Summary page includes trend graphs and summary tables for incoming and outgoing messages.

The Incoming Mail includes graphs and summary tables for the incoming and outgoing messages.

Advanced Malware Protection Report Pages

The following sections are available on the Advanced Malware Protection report page of the Reports menu:

  • Summary

  • AMP File Reputation

  • File Analysis

  • File Retrospection

  • Mailbox Auto Remediation

The email gateway has the following Advanced Malware Protection report pages under Montior menu:

  • Advanced Malware Protection

  • AMP File Analysis

  • AMP Verdict Updates

  • Mailbox Auto Remediation

Outbreak Filters Page

The Past Year Virus Outbreaks and Past Year Virus Outbreak Summary are not available in the Outbreak Filtering report page of the new web interface.

The Monitor > Outbreak Filters page displays the Past Year Virus Outbreaks and Past Year Virus Outbreak Summary.

Spam Quarantines (Administrative and End Users)

Click Quarantine > Spam Quarantine > Search in the new web interface.

The end users can access the spam quarantine using the URL:

https://example.com:<https-api-port>/euq-login

where example.com is the appliance hostname and <https-api-port> is the AsyncOS API HTTPS port opened on the firewall.

You can view spam quarantine from the Monitor > Spam Quarantine menu.

Policy, Virus and Outbreak Quarantines

Click Quarantine > Other Quarantine in the new web interface.

You can only view Policy, Virus and Outbreak Quarantines in the new web interface.

You can view, configure and modify the Policy, Virus and Outbreak Quarantines on the email gateway using the Monitor > Policy, Virus and Outbreak Quarantines.

Select All Action for Messages in Quarantine

You can select multiple (or all) messages and perform a message action such as delete, delay, release, move, etc.

You cannot select multiple messages to perform a message action.

Maximum Download Limit for Attachments

The maximum limit for downloading attachments of a quarantined message is restricted to 25 MB.

-

Rejected Connections

To search for rejected connections, click Tracking > Search > Rejected Connection tab on the .

-

Query Settings

The Query Settings field of the Message Tracking feature is not available on the .

You can set the query timeout in the Query Settings field of the Message Tracking feature.

Message Tracking Data Availability

Click the gear icon on the upper right side of the page the web interface to access Message Tracking Data Availability page.

You can view the missing-data intervals for your email gateway.

Show Additional Details of Messages

You can view additional details of a message such as Verdict Charts, Last State, Sender Groups, Sender IP, IP Reputation Score and Policy Match details.

-

Verdict Charts and Last State Verdicts

Verdict Chart displays information of the various possible verdicts triggered by each engine in your email gateway.

Last State of the message determines the final verdict triggered after all the possible verdicts of the engine.

Verdict Charts and Last State Verdicts of the messages are not available.

Message Attachments and Host Names in Message Details

Message attachments and host names are not displayed in the Message Details section of the message on the email gateway.

Message attachments and host names are displayed in the Message Details section of the message.

Sender Groups, Sender IP, IP Reputation Score and Policy Match in Message Details

Sender Groups, Sender IP, IP Reputation Score, and Policy Match details of the message is displayed in the Message Details section, on the email gateway.

Sender Groups, Sender IP, IP Reputation Score, and Policy Match of the message is not available in the Message Details section of the message.

Direction of the Message (Incoming or Outgoing)

Direction of the message (incoming or outgoing) is displayed in the message tracking results page, on the email gateway.

Direction of the message (incoming or outgoing) is not displayed in the message tracking results page.

Where to Find More Information

Cisco offers the following resources to learn more about your email gateway:

Documentation

You can access the online help version of this user guide directly from the appliance GUI by clicking Help and Support in the upper-right corner.

The documentation set for the Cisco Secure Email Gateway includes the following documents and books:

  • Release Notes
  • Quick Start Guide for your Cisco Email Security Appliance model
  • Cisco Content Security Virtual Appliance Installation Guide
  • User Guide for AsyncOS for Cisco Secure Email Gateway (this book)
  • CLI Reference Guide for AsyncOS for Cisco Secure Email Gateway
  • AsyncOS API for Cisco Secure Email Gateway - Getting Started Guide

Documentation for all Cisco Content Security products is available from:

Documentation For Cisco Content Security Products

Location

Hardware and virtual appliances

See the applicable product in this table.

Cisco Secure Email Gateway

http://www.cisco.com/c/en/us/support/security/ email-security-appliance/tsd- products-support-series-home.html

Cisco Secure Web Appliance

http://www.cisco.com/c/en/us/support/security/ web-security-appliance/tsd-products- support-series-home.html

Cisco Secure Email and Web Manager

http://www.cisco.com/c/en/us/support/ security/content-security-management- appliance/tsd- products-support-series-home.html

CLI Reference Guide for Cisco Secure Email Gateway

http://www.cisco.com/c/en/us/support/security/ email-security-appliance/products-command-reference-list.html

API Getting Started Guide for Cisco Secure Email Gateway

https://www.cisco.com/c/en/us/support/security/email-security-appliance/products-programming-reference-guides-list.html

Privacy Datasheet for Cisco Secure Email Gateway

https://trustportal.cisco.com/c/dam/r/ctp/docs/privacydatasheet/security/cisco-email-security-appliance-privacy-data-sheet.pdf

Cisco Notification Service

Sign up to receive notifications relevant to your Cisco Content Security Appliances, such as Security Advisories, Field Notices, End of Sale and End of Support statements, and information about software updates and known issues.

You can specify options such as notification frequency and types of information to receive. You should sign up separately for notifications for each product that you use.

To sign up, visit http://www.cisco.com/cisco/support/notifications.html

A Cisco.com account is required. If you do not have one, see Registering for a Cisco Account.

Cisco Support Community

The Cisco Support Community is an online forum for Cisco customers, partners, and employees. It provides a place to discuss general email and web security issues, as well as technical information about specific Cisco products. You can post topics to the forum to ask questions and share information with other Cisco users.

Access the Cisco Support Community on the Customer Support Portal at the following URLs:

Cisco Customer Support

Do not contact Cisco Customer Support for help with Cisco Secure Email Gateway. See the Cisco IronPort Hosted Email Security / Hybrid Hosted Email Security Overview Guide for information on getting support for Cloud/Hybrid Email Security appliances.

Cisco TAC: http://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html

Support site for legacy IronPort: http://www.cisco.com/c/en/us/services/acquisitions/ironport.html

For non-critical issues, you can also access customer support from the email gateway. For instructions, see the User Guide or online help.

Third Party Contributors

See Open Source licensing information for your release on this page: http://www.cisco.com/c/en/us/support/security/email-security-appliance/products-release-notes-list.html .

Some software included within Cisco AsyncOS is distributed under the terms, notices, and conditions of software license agreements of FreeBSD, Inc., Stichting Mathematisch Centrum, Corporation for National Research Initiatives, Inc., and other third party contributors, and all such terms and conditions are incorporated in Cisco license agreements.

The full text of these agreements can be found here:

https://support.ironport.com/3rdparty/AsyncOS_User_Guide-1-1.html.

Portions of the software within Cisco AsyncOS is based upon the RRDtool with the express written consent of Tobi Oetiker.

Portions of this document are reproduced with permission of Dell Computer Corporation. Portions of this document are reproduced with permission of McAfee, Inc. Portions of this document are reproduced with permission of Sophos Plc.

Cisco Secure Email Gateway Overview

The AsyncOS™ operating system includes the following features:

  • Anti-Spam at the gateway, through the unique, multi-layer approach of SenderBase Reputation Filters and Cisco Anti-Spam integration.
  • Anti-Virus at the gateway with the Sophos and McAfee Anti-Virus scanning engines.
  • Outbreak Filters™, Cisco’s unique, preventive protection against new virus, scam, and phishing outbreaks that can quarantine dangerous messages until new updates are applied, reducing the window of vulnerability to new message threats.
  • Policy, Virus, and Outbreak Quarantines provide a safe place to store suspect messages for evaluation by an administrator.
  • Spam Quarantine either on-box or off, providing end user access to quarantined spam and suspected spam.
  • Email Authentication. Cisco AsyncOS supports various forms of email authentication, including Sender Policy Framework (SPF), Sender ID Framework (SIDF), and DomainKeys Identified Mail (DKIM) verification of incoming mail, as well as DomainKeys and DKIM signing of outgoing mail.
  • Cisco Email Encryption. You can encrypt outgoing mail to address HIPAA, GLBA and similar regulatory mandates. To do this, you configure an encryption policy on the email gateway and use a local key server or hosted key service to encrypt the message.
  • Email Security Manager, a single, comprehensive dashboard to manage all email security services and applications on the email gateway. Email Security Manager can enforce email security based on user groups, allowing you to manage Cisco Reputation Filters, Outbreak Filters, Anti-Spam, Anti-Virus, and email content policies through distinct inbound and outbound policies.
  • On-box message tracking. AsyncOS for Email includes an on-box message tracking feature that makes it easy to find the status of messages that the E email gateway processes.
  • Mail Flow Monitoring of all inbound and outbound email that provides complete visibility into all email traffic for your enterprise.
  • Access control for inbound senders, based upon the sender’s IP address, IP address range, or domain.
  • Extensive message and content filtering technology allows you to enforce corporate policy and act on specific messages as they enter or leave your corporate infrastructure. Filter rules identify messages based on message or attachment content, information about the network, message envelope, message headers, or message body. Filter actions allow messages to be dropped, bounced, archived, blind carbon copied, or altered, or to generate notifications.
  • Message encryption via secure SMTP over Transport Layer Security ensures messages traveling between your corporate infrastructure and other trusted hosts are encrypted.
  • Virtual Gateway™ technology allows the email gateway to function as several email gateways within a single server, which allows you to partition email from different sources or campaigns to be sent over separate IP addresses. This ensures that deliverability issues affecting one IP address do not impact others.
  • Protection against malicious attachments and links in email messages, provided by multiple services.
  • Use Data Loss Prevention to control and monitor the information that leaves your organization.

AsyncOS supports RFC 2821-compliant Simple Mail Transfer Protocol (SMTP) to accept and deliver messages.

Most reporting, monitoring, and configuration commands are available through both the web-based GUI via HTTP or HTTPS. In addition, an interactive Command Line Interface (CLI) which you access from a Secure Shell (SSH) or direct serial connection is provided for the system.

You can also set up a Cisco Secure Email and Web Manager to consolidate reporting, tracking, and quarantine management for multiple E email gateways.

Related Topics

Supported Languages

AsyncOS can display its GUI and CLI in any of the following languages:

  • English
  • French
  • Spanish
  • German
  • Italian
  • Korean
  • Japanese
  • Portuguese (Brazil)
  • Chinese (traditional and simplified)
  • Russian