IronPort - advanced configuration guide

Chapter 6 Using Message Filters to Enforce Email Policies
Archive Action
OL-25137-01
The IP interface may only be changed to an IP interface or interface group currently configured in the
system. the following filter creates a Virtual Gateway using the outbound (delivery) IP interface
outbound2 for all messages received from a remote host with the IP address 1.2.3.4.
externalFilter:
if(remote-ip == '1.2.3.4')
{
}
the following filter uses the IP interface group Group1 for all messages received from a remote host with
the IP address 1.2.3.4.
groupFilter:
alt-src-host('outbound2');
if(remote-ip == '1.2.3.4')
{
}
alt-src-host('Group1');
The archive action saves a copy of the original message, including all message headers and recipients
into an mbox-format file on the appliance. The action takes a parameter that is the name of the log file
in which to save the message. The system automatically creates a log subscription with the specified
filename when you create the filter, or you can also specify an existing filter log file. After the filter and
the filter log file are created, the filter log options may then be edited with the filters -> logconfig
subcommand.
Note The logconfig command is a subcommand of filters. See Using the CLI to Manage Message Filters,
page 6-75 for a full description of how to use this subcommand.
The mbox format is a standard UNIX mailbox format, and there are many utilities available to make
viewing the messages easier. Most UNIX systems allow you to type
“mail -f mbox.filename” to view the files. The mbox format is in plain text, so you can use a simple
text editor to view the contents of the messages.
In the following example, a copy of the message is saved to a log named joesmith if the Envelope Sender
matches joesmith@yourdomain.com:
logJoeSmithFilter:
if(mail-from == '^joesmith@yourdomain\\.com$')
{
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
6-59