Cisco Cisco Email Security Appliance X1070 Troubleshooting Guide

Contributed by Dominic Yip, Cisco TAC Engineer.

Oct 13, 2014

This document describes what happens to incoming messages on the Cisco Email Security Appliance (ESA) if
the backend server is down.

If your mail server (Microsoft Exchange, Lotus Notes) fails, your incoming emails are queued on your ESA. 

Once your mail server comes back online, the ESA resumes email delivery. The ESA retains messages in its
queue based upon the settings configured in your bounce profile.

By default, mail is queued for 72 hours (259200 seconds) OR 100 retry attempts before it bounces to the
original sender. 

This setting is configurable by using the CLI command bounceconfig and edit the Default profile. This is also
done from the GUI by going to Network > Bounce Profiles, and click on the Default profile.

The queue could fill up if there is too much mail. However, if the system reaches its storage limit, it will soft
bounce further attempts by other mail servers to deliver more messages. This ensures that no messages will
get lost, as these mail servers will reattempt message delivery as well until the ESA accepts messages again.

Note: If you plan to shut down your internal mail server for maintenance for a longer period (more than a
couple hours), the best practice is to suspend the incoming listeners on your ESA using suspendlistener.

As mentioned before, in this case any connection attempts will be soft bounced, and retried later. This way,
you leave the task of storing the messages to the sending mail server, which will prevent the mail queue on
your ESA from filling up quickly. No messages will be lost; however, once you got your internal mail server
back into service, also resume the listeners on your ESA using resume. This will allow delivery from remote
hosts again.

For more information about Directing Bounced Email, see the AsyncOS Email User Guide.