IronPort - Configuration Guide - AsyncOS 7.6.1

OL-25136-01
Reputation Filtering
CHAPTER
7
The Cisco IronPort appliance offers a unique, layered approach to stopping spam at the email gateway.
The first layer of spam control, reputation filtering, allows you to classify email senders and restrict
access to your email infrastructure based on senders’ trustworthiness as determined by the Cisco
IronPort SenderBase Reputation Service. The second layer of defense (discussed in the next chapter),
scanning, is powered by Cisco IronPort Anti-Spam technology. Coupled together, reputation filtering
and anti-spam scanning offer the most effective and highest performing anti-spam solution available
today.
Using the Cisco IronPort appliance, it is very easy to create policies to deliver messages from known or
highly reputable senders — such as customers and partners — directly to the end user without any
anti-spam scanning. Messages from unknown or less reputable senders can be subjected to anti-spam
scanning, and you can also throttle the number of messages you are willing to accept from each sender.
Email senders with the worst reputation can have their connections rejected or their messages bounced
based on your preferences.
The unique, two-layer approach to fighting spam of the Cisco IronPort appliance provides you with a
powerful and unprecedented flexibility to manage and protect your enterprise email gateway.
Note Starting in AsyncOS 7.6, an Email Security appliance requires an anti-spam system feature key in order
to use the SenderBase Reputation Service.
Reputation Filtering
Reputation Filtering, page 7-1
Configuring Reputation Filtering, page 7-6
The SenderBase Reputation Service provides an accurate, flexible way for users to reject or throttle
suspected spam based on the connecting IP address of the remote host. The SenderBase Reputation
Service returns a score based on the probability that a message from a given source is spam and exposes
objective data in the Mail Flow Monitor feature to allow mail administrators to get a more complete
picture of who is sending them email (see “Using Email Security Monitor” in the Cisco IronPort
AsyncOS for Email Daily Management Guide). The SenderBase Reputation Service can is primarily
designed to improve the effectiveness of a content-based anti-spam system such as Cisco IronPort
Anti-Spam and requires anti-spam to be enabled on the service in order to use it.
Using the SenderBase Reputation Service, you can:
Reduce spam
Cisco IronPort AsyncOS 7.6 for Email Configuration Guide
7-1