IronPort - advanced configuration guide

Chapter 3 LDAP Queries
Testing LDAP Queries
OL-25137-01
Microsoft Exchange environments that are aware of each other within the infrastructure can usually
route mail between each other without involving a route back to the originating MTA.
Use the Test Query button on the Add/Edit LDAP Server Profile page (or the test subcommand in the
CLI) of each query type to test the query to the LDAP server you configured. In addition to displaying
the result, AsyncOS also displays the details on each stage of the query connection test. You can test
each of the query types.
The ldaptest command is available as a batch command, for example:
ldaptest LDAP.ldapaccept foo@ironport.com
If you entered multiple hosts in the Host Name field of the LDAP server attributes, the Cisco IronPort
appliance tests the query on each LDAP server.
Table 3-1 summarizes the testing results. (You can also use the ldaptest command.)
Table 3-1 Testing LDAP Queries
Query type If a recipient matches (PASS)... If a recipient does not match (FAIL)...
Recipient Acceptance
(Accept, ldapaccept)
Routing
(Routing, ldaprouting)
Masquerade (Masquerade,
masquerade)
Group Membership (Group,
ldapgroup)
SMTP Auth
(SMTP Authentication,
smtpauth)
External Authentication
(externalauth)
Spam Quarantine End-User
Authentication (isqauth)
Spam Quarantine Alias
Consolidation (isqalias)
Accept the message. Invalid Recipient: Conversation or
delayed bounce or drop the message
per listener settings.
DHAP: Drop.
Route based on the query Continue processing the message.
settings.
Alter the headers with the
variable mappings defined by the
query.
Return “true” for message filter
rules.
A password is returned from the
LDAP server and is used for
authentication; SMTP
Authentication occurs.
Individually returns a “match
positive” for the bind, the user
record, and the user’s group
membership.
Returns a “match positive” for the
end-user account.
Returns the email address that the
consolidated spam notifications
will be sent to.
Continue processing the message.
Return “false” for message filter rules.
No password match can occur; SMTP
Authentication attempts fail.
Individually returns a “match
negative” for the bind, the user record,
and the user’s group membership.
No password match can occur;
End-User Authentication attempts
fail.
No consolidation of spam
notifications can occur.
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
3-17