Cisco Cisco Email Security Appliance C160 Mode D'Emploi

Counting of recipients and recipient rate limiting is done separately for each of these smaller blocks 
(usually, but not always, the equivalent of a /24 CIDR block). 

If the HAT Significant Bits feature is used. In this case, a large block of addresses may be divided 
into smaller blocks by applying the significant bits parameter associated with the policy. 

Note that this parameter relates to the Mail Flow Policy -> Rate Limiting phase. It is not the same 
as the “bits” field in the “network/bits” CIDR notation that may be used to classify IP addresses in 
a Sender Group.

By default, SenderBase Reputation Service and IP Profiling support are enabled for public listeners and 
disabled for private listeners. 

When you configure a listener, you can determine how long the appliance caches information queried 
from the SenderBase Reputation Service. Then when you configure a mail flow policy, you can enable 
SenderBase to allow it to control the flow of mail into the listener.

Enable SenderBase in a mail flow policy in the GUI using the “Use SenderBase for Flow Control” setting 
when you configure a mail flow policy, or in the CLI using the 

listenerconfig > hostaccess > edit

 

command.

Beginning with the 3.8.3 release of AsyncOS, you can track and rate limit incoming mail on a per-IP 
address basis while managing sender group entries in a listener’s Host Access Table (HAT) in large 
CIDR blocks. For example, if an incoming connection matched against the host “10.1.1.0/24,” a counter 
could still be generated for each individual address within that range, rather than aggregating all traffic 
into one large counter.

In order for the significant bits HAT policy option to take effect, you must not enable “User SenderBase” 
in the Flow Control options for the HAT (or, for the CLI, answer 

 to the question for enabling the 

SenderBase Information Service in the 

listenerconfig

 -> setup command: “Would you like to enable 

SenderBase Reputation Filters and IP Profiling support?”). That is, the Hat Significant Bits feature and 
enabling SenderBase IP Profiling support are mutually exclusive. 

In most cases, you can use this feature to define sender groups broadly — that is, large groups of IP 
addresses such as “10.1.1.0/24” or “10.1.0.0/16” — while applying mail flow rate limiting narrowly to 
smaller groups of IP addresses. 

The HAT Significant Bits feature corresponds to these components of the system:

There are two parts of HAT configuration: sender groups and mail flow policies. Sender group 
configuration defines how a sender's IP address is “classified” (put in a sender group). Mail flow policy 
configuration defines how the SMTP session from that IP address is controlled. When using this feature, 
an IP address may be “classified in a CIDR block” (e.g. 10.1.1.0/24) sender group while being controlled 
as an individual host (/32). This is done via the “signficant_bits” policy configuration setting.