Cisco Cisco Email Security Appliance C680 Release Notes

The following change was introduced in AsyncOS 9.6 and applies to upgrades from AsyncOS 8.5.5 
through AsyncOS 9.5. 

If you have deployed multiple content security appliances (email, web, and/or management) and you 
want to view detailed file analysis results in the cloud for all files uploaded from any appliance in your 
organization, you must configure an appliance group on each appliance after upgrading. 

For details, see information about grouping appliances in the “File Reputation Filtering and File 
Analysis” chapter in the user guide PDF. 

Beginning in AsyncOS 9.5: 

The File Analysis cloud server URL has changed, and as a result, the file types that can be analyzed may 
have changed after upgrade. You should receive an alert if there are changes. To verify the file types 
selected for analysis, select Security Services > File Reputation and Analysis. 

Enabling RSA Email DLP for outbound messages on an appliance that is already having anti-spam 
and anti-virus scanning running on inbound messages can cause a performance degradation of less 
than 10%.

Enabling RSA Email DLP on an appliance that is only running outbound messages and is not 
running anti-spam and anti-virus can cause higher performance degradation as compared to the 
previous scenario. 

SenderBase Network Participation now uses the Context Adaptive Scanning Engine (CASE) to collect 
data to power IronPort Information Services. In some configurations customers may experience a 
moderate performance decline.

Outbreak Filters uses the Context Adaptive Scanning Engine to determine the threat level of a message 
and scores messages based on a combination of Adaptive Rules and Outbreak Rules. In some 
configurations, you may experience a moderate performance decline.

Enabling the IronPort Spam Quarantine on-box for a C-Series or X-Series appliance causes a minimal 
reduction in system throughput for nominally loaded appliances. For appliances that are running near or 
at peak throughput, the additional load from an active quarantine may cause a throughput reduction of 
10-20%. If your system is at or near capacity, and you desire to use the IronPort Spam Quarantine, 
consider migrating to a larger C-Series appliance or an M-Series appliance.

If you change your anti-spam policy from dropping spam to quarantining it (either on-box or off-box), 
then your system load will increase due to the need to scan additional spam messages for virus and 
content security. For assistance in properly sizing your installation please contact your authorized 
support provider.