Cisco Cisco Email Security Appliance C170 Guía Del Usuario
C-16
User Guide for AsyncOS 10.0 for Cisco Email Security Appliances
Appendix C Example of Mail Policies and Content Filters
Overview of Incoming Mail Policies
•
When you define more than one Condition for a content filter, you can define whether all of the
defined actions (that is, a logical AND) or any of the defined actions (logical OR) need to apply in
order for the content filter to be considered a match.
defined actions (that is, a logical AND) or any of the defined actions (logical OR) need to apply in
order for the content filter to be considered a match.
•
You can test message splintering and content filters by creating “benign” content filters. For
example, it is possible to create a content filter whose only action is “deliver.” This content filter
will not affect mail processing; however, you can use this filter to test how the mail policy processing
affects other elements in the system (for example, the mail logs).
example, it is possible to create a content filter whose only action is “deliver.” This content filter
will not affect mail processing; however, you can use this filter to test how the mail policy processing
affects other elements in the system (for example, the mail logs).
•
Conversely, using the “master list” concept of the Incoming or Outgoing Content Filters, it is
possible to create very powerful, wide-sweeping content filters that will immediately affect message
processing for all mail handled by the appliance. The process for this is to:
possible to create very powerful, wide-sweeping content filters that will immediately affect message
processing for all mail handled by the appliance. The process for this is to:
–
Use the Incoming or Outgoing Content Filters page to create a new content filter whose order
is 1.
is 1.
–
Use the Incoming or Outgoing Mail Policies page to enable the new content filter for the default
policy.
policy.
–
Enable the content filter for all remaining policies.
•
The Bcc: and Quarantine actions available in Content Filters can help you determine the retention
settings of quarantines you create. (See
settings of quarantines you create. (See
) You
can create filters that would simulate mail flow into and out of your policy quarantines so that
messages are not released too quickly from the system (that is, the quarantine areas do not fill their
allotted disk space too quickly).
messages are not released too quickly from the system (that is, the quarantine areas do not fill their
allotted disk space too quickly).
•
Because it uses the same settings as the Scan Behavior page or the
scanconfig
command, the
“Entire Message” condition does not scan a message’s headers; choosing the “Entire Message” will
scan only the message body and attachments. Use the “Subject” or “Header” conditions to search
for specific header information.
scan only the message body and attachments. Use the “Subject” or “Header” conditions to search
for specific header information.
•
Configuring users by LDAP query will only appear in the GUI if you have LDAP servers configured
on the appliance (that is, you have configured the appliance to query specific LDAP servers with
specific strings using the
on the appliance (that is, you have configured the appliance to query specific LDAP servers with
specific strings using the
ldapconfig
command).
•
Some sections of the content filter rule builder will not appear in the GUI if the resource has not
been preconfigured. For example, notification templates and message disclaimers will not appear as
options if they have not been configured previously using the Text Resources page or the
been preconfigured. For example, notification templates and message disclaimers will not appear as
options if they have not been configured previously using the Text Resources page or the
textconfig
command in the CLI.
•
Content filters features will recognize, can contain, and/or scan for text in the following character
encodings:
encodings:
–
Unicode (UTF-8)
–
Unicode (UTF-16)
–
Western European/Latin-1 (ISO 8859-1)
–
Western European/Latin-1 (Windows CP1252)
–
Traditional Chinese (Big 5)
–
Simplified Chinese (GB 2312)
–
Simplified Chinese (HZ GB 2312)
–
Korean (ISO 2022-KR)
–
Korean (KS-C-5601/EUC-KR)
–
Japanese (Shift-JIS (X0123))
–
Japanese (ISO-2022-JP)