Руководство Пользователя для Cisco Cisco Email Security Appliance C170

You can configure your IronPort appliance to scan for viruses using the McAfee 
or Sophos anti-virus scanning engines.

The McAfee and Sophos engines contain the program logic necessary to scan files 
at particular points, process and pattern-match virus definitions with data they 
find in your files, decrypt and run virus code in an emulated environment, apply 
heuristic techniques to recognize new viruses, and remove infectious code from 
legitimate files. 

Your IronPort appliance ships with a 30-day evaluation key for each available 
anti-virus scanning engine. You enable the evaluation key by accessing the license 
agreement in the System Setup Wizard or Security Services > Sophos/McAfee 
Anti-Virus pages (in the GUI) or running the 

antivirusconfig

 or 

systemsetup

 

commands (in the CLI). Once you have accepted the agreement, the Anti-Virus 
scanning engine will be enabled, by default, for the default incoming and outgoing 
mail policies. For information on enabling the feature beyond the 30-day 
evaluation period, contact your IronPort sales representative. You can see how 
much time remains on the evaluation via the System Administration > Feature 
Keys page or by issuing the 

featurekey

 command. (For more information, see the 

section on working with feature keys in “Common Administrative Tasks” in the 
Cisco IronPort AsyncOS for Email Daily Management Guide).

AsyncOS supports scanning messages with multiple anti-virus scanning engines 
— multi-layer anti-virus scanning. You can configure your IronPort appliance to 
use one or both of the licensed anti-virus scanning engines on a per mail policy 
basis. You could create a mail policy for executives, for example, and configure 
that policy to scan mail with both Sophos and McAfee engines.

Scanning messages with multiple scanning engines provides “defense in depth” 
by combining the benefits of both Sophos and McAfee anti-virus scanning 
engines. Each engine has leading anti-virus capture rates, but because each engine 
relies on a separate base of technology (discussed in