Cisco Cisco Email Security Appliance C160 用户指南
C H A P T E R
8-1
Cisco IronPort AsyncOS 7.6 for Email Configuration Guide
OL-25136-01
8
Anti-Virus
The Cisco IronPort appliance includes integrated virus scanning engines from Sophos, Plc and McAfee,
Inc. You can obtain license keys for the Cisco IronPort appliance to scan messages for viruses using one
or both of these virus scanning engines.
Inc. You can obtain license keys for the Cisco IronPort appliance to scan messages for viruses using one
or both of these virus scanning engines.
You can configure the appliance to scan messages for viruses (based on the matching incoming or
outgoing mail policy), and, if a virus is found, to perform different actions on the message (including
“repairing” the message of viruses, modifying the subject header, adding an additional X-header,
sending the message to an alternate address or mailhost, archiving the message, or deleting the message).
outgoing mail policy), and, if a virus is found, to perform different actions on the message (including
“repairing” the message of viruses, modifying the subject header, adding an additional X-header,
sending the message to an alternate address or mailhost, archiving the message, or deleting the message).
If enabled, virus scanning is performed in the “work queue” on the appliance, immediately after
Anti-Spam scanning. (See
Anti-Spam scanning. (See
.)
By default, virus scanning is enabled for the default incoming and outgoing mail policies.
•
•
•
•
•
•
Anti-Virus Scanning
You can configure your Cisco IronPort appliance to scan for viruses using the McAfee or Sophos
anti-virus scanning engines.
anti-virus scanning engines.
The McAfee and Sophos engines contain the program logic necessary to scan files at particular points,
process and pattern-match virus definitions with data they find in your files, decrypt and run virus code
in an emulated environment, apply heuristic techniques to recognize new viruses, and remove infectious
code from legitimate files.
process and pattern-match virus definitions with data they find in your files, decrypt and run virus code
in an emulated environment, apply heuristic techniques to recognize new viruses, and remove infectious
code from legitimate files.
Evaluation Key
Your Cisco IronPort appliance ships with a 30-day evaluation key for each available anti-virus scanning
engine. You enable the evaluation key by accessing the license agreement in the System Setup Wizard
or Security Services > Sophos/McAfee Anti-Virus pages (in the GUI) or running the
engine. You enable the evaluation key by accessing the license agreement in the System Setup Wizard
or Security Services > Sophos/McAfee Anti-Virus pages (in the GUI) or running the
antivirusconfig
or
systemsetup
commands (in the CLI). Once you have accepted the agreement, the Anti-Virus scanning