IronPort - daily management guide - AsyncOS 7.6.1

Chapter 4 Quarantines
OL-25138-01
Table 4-5 Synchronization for Safelist and Blocklist Settings
Appliance Synchronization Time
C650/C660/C670 30 minutes
X1050/X1060/X1070 60 minutes
M600/M660 120 minutes
M1000/M1050/M1060 240 minutes
Working with Safelists and Blocklists
When you use a group of C-Series appliances without an M-Series appliance, you may need to
synchronize the safelist/blocklist settings and database across machines.
If you use the centralized management feature to configure multiple Cisco IronPort appliances, you can
configure administrator settings using centralized management. If you do not use centralized
management, you can manually verify that settings are consistent across machines.
For more information about accessing the appliance using FTP see “Accessing the Appliance” in either
the Cisco IronPort AsyncOS for Email Configuration Guide or the Cisco IronPort AsyncOS for Email
Advanced Configuration Guide.
Troubleshooting Safelists and Blocklists
An end user maintains his or her own safelists and blocklists. Administrators can access an end user’s
safelist or blocklist only by logging into the end user account with the user’s login and password. To
troubleshoot issues with safelists and blocklists, you can view the log files or system alerts.
When an email is blocked due to safelist/blocklist settings, the action is logged in the ISQ_logs or the
antispam log files. Emails that are safelisted are marked as safelisted with an X-SLBL-Result-Safelist
header. Emails that are blocklisted are marked as blocklisted with an X-SLBL-Result-Blocklist header.
Alerts are sent out when the database is created, updated, or if there are errors in modifying the database
or running the safelist/blocklist processes.
For more information about alerts, see “System Administration” in the Cisco IronPort AsyncOS for
Email Configuration Guide.
For more information about log files, see Chapter 5, “Logging.”
End User Tasks for Configuring Safelists and Blocklists
End users can create safelists to ensure that messages from certain senders are never treated as spam,
and they can use blocklists to ensure that messages from certain senders are always treated as spam. For
example, an end user may receive email from a mailing list that no longer interests him. He may decide
to add this sender to his blocklist to prevent emails from the mailing list from getting sent to his inbox.
On the other hand, end users may find that emails from specific senders get sent to their Cisco IronPort
Spam Quarantine when they don’t want them to be treated as spam. To ensure mail from these senders
are not quarantined, they may want to add the senders to their safelists.
Note Safelist/Blocklist settings are contingent on other settings configured by the system administrator.
To work with safelists and blocklists, end users must complete the following tasks:
Cisco IronPort AsyncOS 7.6 for Email Daily Management Guide
4-41