IronPort - daily management guide - AsyncOS 7.6.1

Chapter 4 Quarantines
Disk Space
OL-25138-01
Configuring the Cisco IronPort Spam Quarantines Feature
Table 4-3 shows the amount of disk space available on each appliance for the Cisco IronPort Spam
Quarantine.
Table 4-3 Disk Space Available for Cisco IronPort Spam Quarantine by Cisco IronPort Appliance
End Users Accessing the Cisco IronPort Spam Quarantine
LDAP Authentication
Model Disk Space (in GBytes)
C150/160 5
C350/360/370 15
C650/660/670 30
X1050/1060/1070 30
End users can access the Cisco IronPort Spam quarantine via a link in the notification they receive. When
accessing the quarantine via this method, LDAP or IMAP/POP authentication is not required (end users
do not have to authenticate themselves). Note that the links present in the notification messages do not
expire, so end users can use these links to view their quarantined messages without having to
authenticate.
Users can also access the quarantine by entering a link in their web browser directly. When accessing
the quarantine via a URL typed into a web browser, users will have to authenticate. The authentication
method — LDAP or “mailbox” (IMAP/POP) — is defined in the End User Quarantine Access section
of the quarantine settings (see Configuring End User Quarantine Access, page 4-24).
The authentication process for LDAP works like this:
Step 1 A user enters their username and password into the web UI login page.
Step 2 The Cisco IronPort Spam quarantine connects to the specified LDAP server either to perform an
anonymous search or as an authenticated user with the specified “Server Login” DN and password. For
Active Directory, you will usually need to have the server connect on the “Global Catalog port” (it is in
the 6000s) and you need to create a low privilege LDAP user that the Cisco IronPort Spam quarantine
can bind as in order to execute the search.
Step 3 The Cisco IronPort Spam quarantine then searches for the user using the specified BaseDN and Query
String. When a user’s LDAP record is found, the Cisco IronPort Spam quarantine then extracts the DN
for that record and attempts bind to the directory using the user records’ DN and the password they
entered originally. If this password check succeeds then the user is properly authenticated, but the Cisco
IronPort Spam quarantine still needs to determine which mailboxes’ contents to show for that user.
Step 4 Messages are stored in the Cisco IronPort Spam quarantine using the recipient's envelope address. After
a user's password is validated against LDAP, the Cisco IronPort Spam quarantine then retrieves the
“Primary Email Attribute” from the LDAP record to determine which envelope address they should show
quarantined messages for. The “Primary Email Attribute” can contain multiple email addresses which
are then used to determine what envelope addresses should be displayed from the quarantine for the
authenticated user.
Cisco IronPort AsyncOS 7.6 for Email Daily Management Guide
4-31