Руководство Пользователя для Cisco Cisco Email Security Appliance C170

The Cisco IronPort appliance includes integrated virus scanning engines from Sophos, Plc and McAfee, 
Inc. You can obtain license keys for the Cisco IronPort appliance to scan messages for viruses using one 
or both of these virus scanning engines.

You can configure the appliance to scan messages for viruses (based on the matching incoming or 
outgoing mail policy), and, if a virus is found, to perform different actions on the message (including 
“repairing” the message of viruses, modifying the subject header, adding an additional X-header, 
sending the message to an alternate address or mailhost, archiving the message, or deleting the message).

If enabled, virus scanning is performed in the “work queue” on the appliance, immediately after 
Anti-Spam scanning. (See 

.)

By default, virus scanning is enabled for the default incoming and outgoing mail policies. 

 

You can configure your Cisco IronPort appliance to scan for viruses using the McAfee or Sophos 
anti-virus scanning engines.

The McAfee and Sophos engines contain the program logic necessary to scan files at particular points, 
process and pattern-match virus definitions with data they find in your files, decrypt and run virus code 
in an emulated environment, apply heuristic techniques to recognize new viruses, and remove infectious 
code from legitimate files. 

Your Cisco IronPort appliance ships with a 30-day evaluation key for each available anti-virus scanning 
engine. You enable the evaluation key by accessing the license agreement in the System Setup Wizard 
or Security Services > Sophos/McAfee Anti-Virus pages (in the GUI) or running the 

antivirusconfig

 

or 

systemsetup

 commands (in the CLI). Once you have accepted the agreement, the Anti-Virus scanning