Cisco Cisco Email Security Appliance C160 Mode D'Emploi

of users. You can also treat positively identified spam differently from suspected spam in the same 
policy. For example, you may want to drop messages positively identified as spam, but quarantine 
suspected spam messages.

For each mail policy, you can specify thresholds for some of the categories, and determine the action to 
take for each category. You can assign different users to different mail policies and define different 
scanning engines, spam-definition thresholds, and spam-handling actions for each policy. 

For information about how and when anti-spam scanning is applied, see 

Your Cisco appliance offers the following anti-spam solutions: 

You can license and enable both these solutions on your Cisco appliance, but you can only use one in a 
particular mail policy. You can specify a different anti-spam solution for different groups of users. 

Enable anti-spam scanning on the Email Security 
appliance. 

Remaining steps in this table apply to both 
scanning engine options.

If you have feature keys for both Cisco IronPort Anti-Spam 
and Intelligent Multi-Scan, you can enable both solutions 
on the appliance. 

 

 

Configure whether to quarantine spam on the local 
Email Security appliance or use an external quarantine 
on a Security Management appliance.

.

Define the groups of users whose messages you want to 
scan for spam.

Configure the anti-spam scanning rules for the user 
groups you defined.

If you want certain messages to skip Cisco Anti-Spam 
scanning, create message filters that use the 

skip-spamcheck

 action. 

 

(Recommended) Enable SenderBase Reputation Service 
scoring for each inbound mail flow policy, even if you 
are not rejecting connections based on SenderBase 
Reputation Scores. 

For each inbound mail flow policy, ensure that “Use 
SenderBase for Flow Control” is On. 

See