Cisco Cisco Email Security Appliance C170 Guia Do Utilizador

Página de 652
7-11
Cisco IronPort AsyncOS 7.5 for Email Configuration Guide
OL-25136-01
Chapter 7      Reputation Filtering
For example, for “SUSPECTLIST,” enter a range from -4.0 to 0. Refer to 
 for the 
syntax. 
Step 4
Click Submit
Repeat steps 2-5 for each group in the listener’s HAT. For example, define the 
values for conservative approach. You can configure the values shown in 
 for a moderate or aggressive approach as well.
Note
Remember that order matters when defining sender groups in a listener’s 
HAT. (The HAT is read from top to bottom for each host that attempts to 
connect to the listener. If a rule matches a connecting host, the action is 
taken for that connection immediately.) Cisco recommends maintaining 
the default order of the predefined sender groups in a listener’s HAT — 
that is, RELAYLIST (C10/100 customers only), followed by 
WHITELIST, BLACKLIST, SUSPECTLIST, and UNKNOWNLIST.
Step 5
Click the Commit Changes button, add an optional comment if necessary, and 
then click Commit Changes to finish implementing reputation filtering in a 
listener’s HAT. 
Testing Reputation Filtering Using the SBRS
Unless you regularly receive a large portion of spam, or you have set up “dummy” 
accounts to specifically receive spam for your organization, it may be difficult to 
immediately test the SBRS policies you have implemented. However, if you add 
entries for reputation filtering with SenderBase Reputation Scores into a listener’s 
HAT as indicated in 
, you will notice that a smaller percentage of 
inbound mail will be “unclassified.”
Sender Group
SBRS Range
Mail Flow 
Policy
WHITELIST
6 to 10
TRUSTED
BLACKLIST
-10 to -7
BLOCKED
SUSPECTLIST
-7 to -2
THROTTLED
UNKOWNLIST
-2 to 6
ACCEPTED