Cisco Cisco Email Security Appliance C160 Mode D'Emploi
9-113
Cisco AsyncOS 9.5 for Email User Guide
Chapter 9 Using Message Filters to Enforce Email Policies
Message Filter Examples
Same Listener for Deliver and Listener Filter
Use the same listener for delivery and receiving. This filter will allow you to send any messages received
on the public listener “listener1” out the interface “listener1” (you will have to set up a unique filter for
each public listener configured):
on the public listener “listener1” out the interface “listener1” (you will have to set up a unique filter for
each public listener configured):
Single Listener Filter
Make the filter work on a single listener. For example, specify a specific listener for message filter
processing instead of being performed system wide.
processing instead of being performed system wide.
Drop Spoofed Domain Filter (Single Listener)
Drop email with a spoofed domain (pretending to be from an internal address; works with a single
listener). IP addresses below represent fictional domain for
listener). IP addresses below represent fictional domain for
mycompany.com
:
Drop Spoofed Domain Filter (Multiple Listeners)
As above, but works with multiple listeners:
same_listener:
if (recv-inj == 'listener1') {
alt-src-host('listener1');
}
textfilter-new:
if (recv-inj == 'inbound' and body-contains("some spammy message")) {
alt-rcpt-to ("spam.quarantine@spam.example.com");
}
DomainSpoofed:
if (mail-from == "mycompany\\.com$") {
if ((remote-ip != "1.2.") AND (remote-ip != "3.4.")) {
drop();
}
}
domain_spoof:
if ((recv-listener == "Inbound") and (mail-from == "@mycompany\\.com")) {