Cisco Cisco Email Security Appliance C190 Guía Del Usuario
9-27
User Guide for AsyncOS 9.8 for Cisco Email Security Appliances
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Rules
Body Size Rule
Body size refers to the size of the message, including both headers and attachments. The
body-size
rule
selects those messages where the body size compares as directed to a given number. For example, the
following filter bounces any message where the body size is greater than 5 megabytes.
following filter bounces any message where the body size is greater than 5 megabytes.
The
body-size
can be compared in the following ways:
As a convenience, the size measurement may be specified with a suffix:
Remote IP Rule
The
remote-ip
rule tests to see if the IP address of the host that sent that message matches a certain
pattern. The IP address can be either Internet Protocol version 4 (IPv4) or Internet Protocol version 6
(IPv6). The IP address pattern is specified using the allowed hosts notation described in “Sender Group
Syntax”, except for the
(IPv6). The IP address pattern is specified using the allowed hosts notation described in “Sender Group
Syntax”, except for the
SBO
,
SBRS
,
dnslist
notations and the special keyword
ALL
.
The allowed hosts notation can only identify sequences and numeric ranges of IP addresses (not
hostnames). For example, the following filter bounces any message not injected from IP addresses of
form
hostnames). For example, the following filter bounces any message not injected from IP addresses of
form
10.1.1.
x where
X
is
50
,
51
,
52
,
53
,
54
, or
55
.
BigFilter:
if (body-size > 5M)
{
bounce();
}
Example
Comparison Type
body-size < 10M
Less than
body-size <= 10M
Less than or equal
body-size > 10M
Greater than
body-size >= 10M
Greater than or equal
body-size == 10M
Equal
body-size != 10M
Not equal
Quantity
Description
10b
ten bytes (same as 10)
13k
thirteen kilobytes
5M
five megabytes
40G
40 gigabytes (Note: The Cisco appliance cannot accept messages larger than 100
megabytes.)
megabytes.)
notMineFilter:
if (remote-ip != '10.1.1.50-55')