IronPort - advanced configuration guide

Chapter 6 Using Message Filters to Enforce Email Policies
Message Filter Example Syntax
OL-25137-01
The intuitive meaning of a filter specification is:
if the message matches the rule, then apply the actions in sequence. If the else clause is present, the
actions within the else clause are executed in the event the message does not match the rule.
The name of the filter you specify makes it easier to manage filters when you are activating, deactivating,
or deleting them.
Message filters use the following syntax:
Example Syntax Purpose
expedite: filter name
if (recv-listener == 'InboundMail' or recv-int == 'notmain') rule specification
{
alt-src-host('outbound1');
skip_filters();
}
else
{
alt-src-host('outbound2');
}
Note that you can omit any alternative actions:
You can combine several filters in sequence within a single text file, one following the other.
You must enclose the values in filters in either single or double quotation marks. Single or double
quotation marks must be equally paired on each side of the value; for example, the expressions
notify('customercare@example.com') and notify("customercare@example.com") are both legal, but
the expression notify("customercare@example.com') causes a syntax error.
Lines beginning with a ‘#’ character are considered comments and are ignored; however, they are not
preserved by AsyncOS as can be verified by viewing a filter via filters -> detail.
Message Filter Processing
action specification
optional alternative action
specification
Example Syntax Purpose
expedite2: filter name
if ((not (recv-listener == 'InboundMail')) and rule specification
(not (recv-int == 'notmain')))
{
action specification
alt-src-host('outbound2');
skip_filters();
}
When AsyncOS processes message filters, the content that AsyncOS scans, the order of the processing,
and the actions taken are based on several factors:
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
6-3