Cisco Cisco Email Security Appliance C160 Mode D'Emploi

 

Cisco IronPort Intelligent Multi-Scan incorporates multiple anti-spam scanning engines, including 
Cisco IronPort Anti-Spam, to provide an intelligent, multi-layer anti-spam solution. This method 
provides more accurate verdicts that increase the amount of spam that is caught but without increasing 
the false positives rate.

When processed by Cisco IronPort Intelligent Multi-Scan, a message is first scanned by third-party 
anti-spam engines. Cisco IronPort Intelligent Multi-Scan then passes the message and the verdicts of the 
third-party engines to Cisco IronPort Anti-Spam, which assumes responsibility for the final verdict. 
After Cisco IronPort Anti-Spam performs its scan, it returns a combined multi-scan score to AsyncOS. 
Combining the benefits of the third-party scanning engines and Cisco IronPort Anti-Spam results in 
more caught spam while maintaining Cisco IronPort Anti-Spam’s low false positive rate. 

You cannot configure the order of the scanning engines used in Cisco IronPort Intelligent Multi-Scan; 
Cisco IronPort Anti-Spam will always be the last to scan a message and Cisco IronPort Intelligent 
Multi-Scan will not skip it if a third-party engine determines that a message is spam.

Using Cisco IronPort Intelligent Multi-Scan can lead to reduced system throughput. Please contact your 
Cisco IronPort support representative for more information.

This feature is supported on all C-Series and X-Series appliances, except for the C100 appliance.

The Intelligent Multi-Scan feature key also enables Cisco IronPort Anti-Spam on the appliance, giving 
you the option of enabling either Cisco IronPort Intelligent MultiScan or Cisco IronPort Anti-Spam for 
a mail policy.

You enable Cisco IronPortIntelligent Multi-Scan and modify its global configuration settings using the 
Security Services > IronPort Intelligent Multi-Scan and Security Services > Service Updates pages 
(GUI) or the 

antispamconfig

 and 

updateconfig

 commands (CLI). The following global settings are 

configured: 

Enable Cisco IronPort Intelligent Multi-Scan globally for the appliance. 

Configure the maximum size of message to be scanned by Cisco IronPort Intelligent Multi-Scan.

Enter a length of time to wait for timeout when scanning a message.

Most users will not need to change the maximum message size to be scanned or the timeout value. 
That said, you may be able to optimize the throughput of your appliance by lowering the maximum 
message size setting.

Define and (optionally) enable a proxy server for obtaining Cisco IronPort Intelligent Multi-Scan 
rules updates (Security Services > Service Updates). If you define a proxy server to retrieve rules 
updates, you can optionally configure an authenticated username, password, and specific port when 
connecting to the proxy server.

Define and (optionally) enable a download server from which to receive Cisco IronPort Intelligent 
Multi-Scan rules updates (Security Services > Service Updates).

Enable or disable receiving automatic updates to Cisco IronPort Intelligent Multi-Scan rules, and 
also specify the update interval.