IronPort - Configuration Guide - AsyncOS 7.6.1

7-4
Figure 7-1 The SenderBase Reputation Service
5 250-Recipient Accepted
or 452-Too many recipients this hour
Sending MTA
or 554-Access Denied
IronPort appliance
SenderBase Affiliate Network
Step 1 SenderBase affiliates send real-time, global data
Step 2 Sending MTA opens connection with the Cisco IronPort appliance
Step 3 Cisco IronPort appliance checks global data for the connecting IP address
Cisco IronPort AsyncOS 7.6 for Email Configuration Guide
Chapter 7 Reputation Filtering
Step 4 SenderBase Reputation Service calculates the probability this message is spam and assigns a SenderBase
Reputations Score
Step 5 Cisco IronPort returns the response based on the SenderBase Reputation Score
Implementing SenderBase Reputation Filters
2
HELO
1
Global complaint data
Global volume data
3 4
1.2.3.4
SBRS = x.x
SBRS Scoring Engine
1.2.3.4 Rule hits
for 1.2.3.4
Cisco IronPort Reputation Filter technology aims to shunt as much mail as possible from the remaining
security services processing that is available on the Cisco IronPort appliance. (See Understanding the
Email Pipeline, page 4-1.)
When enabling reputation filtering, mail from known bad senders is simply refused. Known good mail
from global 2000 companies is automatically routed around the spam filters, reducing the chance of false
positives. Unknown, or “grey” email is routed to the anti-spam scanning engine. Using this approach,
reputation filters can reduce the load on the content filters by as much as 50%.
OL-25136-01