Cisco Cisco Email Security Appliance C160 Mode D'Emploi
8-10
Cisco IronPort AsyncOS 7.6 for Email Configuration Guide
OL-25136-01
Chapter 8 Anti-Virus
Virus Infected Message Handling
The system may be unable to drop the attachment or completely repair a message. In these cases, you
can configure how the system handles messages that could still contain viruses.
can configure how the system handles messages that could still contain viruses.
The configuration options are the same for encrypted messages, unscannable messages, and virus
messages.
messages.
Configuring Settings for Message Handling Actions
Action to Apply
Choose which overall action to take on each message type for encrypted, unscannable, or virus positive
messages: drop the message, deliver the message as an attachment to a new message, deliver the message
as is, or send the message to the anti-virus quarantine area (
messages: drop the message, deliver the message as an attachment to a new message, deliver the message
as is, or send the message to the anti-virus quarantine area (
). See the “Quarantines” chapter in Cisco IronPort AsyncOS for Email Daily Management
Guide for more information about quarantines.
Configuring the appliance to deliver the infected messages as an attachment to a new message allows the
recipient to choose how to deal with the original, infected attachment.
recipient to choose how to deal with the original, infected attachment.
If you choose to deliver the message or deliver the message as an attachment to a new message, you can
additionally:
additionally:
•
Modify message subject
•
Archive original message
•
Send generic notification
The following actions are available in the “Advanced” section of the GUI:
•
Add custom header to message
•
Modify message recipient
•
Send message to alternate destination host
•
Send custom alert notification (to recipient only)
Note
These actions are not mutually exclusive; you can combine some or all of them differently within
different incoming or outgoing policies for different processing needs for groups of users. See the
following sections and
different incoming or outgoing policies for different processing needs for groups of users. See the
following sections and
various scanning policies using these options.
Note
Repaired messages have only two advanced options: Add custom header and Send custom alert
notification. All other message types have access to all of the advanced options.
notification. All other message types have access to all of the advanced options.
Quarantines and Anti-Virus Scanning
When flagged for quarantine, the message continues through the rest of the email pipeline. When the
message reaches the end of the pipeline, if the message has been flagged for one or more quarantines
then it enters those queues. Note that if the message does not reach the end of the pipeline, it is not placed
in a quarantine.
message reaches the end of the pipeline, if the message has been flagged for one or more quarantines
then it enters those queues. Note that if the message does not reach the end of the pipeline, it is not placed
in a quarantine.