IronPort - daily management guide - AsyncOS 7.6.1

Chapter 4 Quarantines
OL-25138-01
Working with Safelists and Blocklists
Administrator Tasks for Creating and Maintaining Safelists and Blocklists
To use safelists and blocklists, the administrator must complete the following tasks:
Enable and configure the Cisco IronPort Spam Quarantine. Because the safelist and blocklist is
accessed from the Cisco IronPort Spam Quarantine, you must enable this feature to use safelists and
blocklists. For information, see Configuring the Cisco IronPort Spam Quarantines Feature,
page 4-18.
Enable and configure the Safelist/Blocklist feature. Once the Cisco IronPort Spam Quarantine is
enabled, you enable and configure the Safelist/Blocklist feature. You must also configure a blocklist
action for blocklisted email (quarantine or delete). For information, see Enabling and Configuring
Safelist/Blocklist Settings, page 4-39
Backup and restore the Safelist/Blocklist database. When upgrading, you need to backup and
restore the Safelist/Blocklist database. For information, see Backing Up and Restoring the
Safelist/Blocklist Database, page 4-40.
Synchronize Safelist/Blocklist databases. When end users enter safelist or blocklist entries, the
settings are saved to a database which is periodically synchronized with a database that is used by
AsyncOS when processing email. If the Cisco IronPort Spam Quarantine is maintained on an
M-Series appliance, the administrator must configure the Safelist/Blocklist database to synchronize
with the C-Series appliance. For information, see Synchronizing Safelist and Blocklist Settings and
Databases, page 4-40.
Troubleshooting Safelists and Blocklists. To troubleshoot safelists and blocklists, you can check
logs, alerts. For more information, see Troubleshooting Safelists and Blocklists, page 4-41.
Enabling and Configuring Safelist/Blocklist Settings
You can enable and configure settings for safelists and blocklists from the Quarantines page.
Step 1 To enable safelists and blocklists on a C-Series appliance, go to Monitor > Quarantines.
Note You must have the Cisco IronPort Spam Quarantine enabled and configured before you can
configure safelists and blocklists.
Step 2 In the End-User Safelist/Blocklist settings, select Edit Settings.
Figure 4-26 End-User Safelist/Blocklist Settings
Step 3 Select Enable Safelist/Blocklist Feature.
Step 4 Select Quarantine or Delete for the Blocklist Action.
Step 5 Specify the Maximum List Items Per User. This value represents the maximum number of addresses or
domains a user can list in each safe and block list.
Step 6 Click Submit.
Cisco IronPort AsyncOS 7.6 for Email Daily Management Guide
4-39