IronPort - daily management guide - AsyncOS 7.6.1

Chapter 4 Quarantines
Cisco IronPort Spam Quarantine Settings
Spam Quarantine Settings
OL-25138-01
Configuring the Cisco IronPort Spam Quarantines Feature
Set quarantine size, deletion/retention policy, default language, and enable or disable Cisco IronPort
notification. By default the local Cisco IronPort Spam quarantine is self-managing. This means that,
once enabled, the quarantine will automatically delete spam after a set amount of time. If the quarantine
gets full, older spam is deleted. You can configure and customize the look and behavior of the Cisco
IronPort Spam quarantine, including specifying a custom logo and login page message. See Configuring
Spam Quarantine Settings for the Local Cisco IronPort Spam Quarantine, page 4-22.
Specify AsyncOS Operator users that may view or interact with the messages in the local Cisco IronPort
Spam quarantine. All Administrator level users (such as the default ‘admin’ user) created in AsyncOS
are automatically able to access and modify the Cisco IronPort Spam quarantine. Operators can view
quarantine contents, but may not change the quarantine settings. See Configuring Administrative Users
for Cisco IronPort Spam Quarantines, page 4-23.
Cisco IronPort Spam Quarantine Access
Spam Notifications
Allow end users to access and manage their messages in the Cisco IronPort Spam quarantine directly via
a web browser. Users with access will be able to view, search, release, and delete messages from the
quarantine regardless of whether they have received a spam notification. Specify whether to hide or show
message bodies. You can specify the end user authentication used (LDAP, Active Directory, IMAP/POP,
or None). See Configuring End User Quarantine Access, page 4-24. Specifying “None” indicates that
end users will only be allowed to access the Cisco IronPort Spam Quarantine via the links included in
notification messages, but they will not be authenticated (does not require a username and password).
Table 4-2 End User Authentication and Access
Authentication Users Access Via...
LDAP URL, Notification
Mailbox (IMAP/POP) URL, Notification
None Notification Only
Disabled N/A (If enabled, notifications are sent to the “Deliver Bounce
Messages To:” address configured via the Spam Notifications
section.)
A notification is a digest of new spam messages in the Cisco IronPort Spam quarantine for a particular
user. Enable and configure the content of the spam notifications, including: the From: address, subject,
message body, message format, bounce address, and notification schedule. Notifications allow end users
to access their quarantined messages without using LDAP or mailbox authentication, providing Cisco
IronPort Spam Quarantine access is enabled. Notifications are sent to each Envelope Recipient that has
quarantined email, including mailing lists and other aliases. Each mailing list will receive a single digest.
This means that all subscribers to a mailing list will receive the notification and can log in to the
quarantine to release or delete messages. In this case, users visiting the quarantine to view messages
mentioned in a notification may find those messages have already been deleted by other users. Users
belonging to multiple aliases and/or using multiple email addresses will receive multiple notifications
(see Receiving Multiple Notifications, page 4-33). See Configuring Spam Notifications, page 4-25.
Cisco IronPort AsyncOS 7.6 for Email Daily Management Guide
4-21