IronPort - Configuration Guide - AsyncOS 7.6.1

9-4
Cisco IronPort AsyncOS 7.6 for Email Configuration Guide
Chapter 9 Anti-Spam
Anti-Spam Scanning and Messages Generated by the Cisco IronPort Appliance
Cisco recommends that recipients who receive email alerts, scheduled reports, and other automated
messages from the Cisco IronPort appliance be placed in an incoming mail policy that bypasses
anti-spam scanning. These messages may contain URLs or other information associated with spam
sources not ordinarily found in a company's mail stream which may occasionally cause such messages
to be marked as SPAM. Alternatively, you can choose to add the IP addresses sending mail on behalf of
the Cisco IronPort appliance to the 'WHITELIST' policy in the host access table (see Adding a Sender
to a Sender Group, page 5-33). For more information, please contact your authorized Cisco IronPort
appliance support center.
Cisco IronPort Anti-Spam Filtering
Evaluation Key
Cisco IronPort Anti-Spam uses conventional techniques and innovative context-sensitive detection
technology to eliminate a diverse range of known and emerging email threats.
Your Cisco IronPort appliance ships with a 30-day evaluation key for the Cisco IronPort Anti-Spam
software. This key is not enabled until you accept the license agreement in the system setup wizard or
Security Services > IronPort Anti-Spam pages (in the GUI) or the systemsetup or antispamconfig
commands (in the CLI). Once you have accepted the agreement, Cisco IronPort Anti-Spam will be
enabled, by default, for the default incoming Mail Policy. An alert is also sent to the administrator
address you configured (see Step 2: System, page 3-15) noting that the Cisco IronPort Anti-Spam license
will expire in 30 days. Alerts are sent 30, 15, 5, and 0 days prior to expiration. For information on
enabling the feature beyond the 30-day evaluation period, contact your Cisco IronPort sales
representative. You can see how much time remains on the evaluation via the System Administration >
Feature Keys page or by issuing the featurekey command. (For more information, see the section on
working with feature keys in “Common Administrative Tasks” in the Cisco IronPort AsyncOS for Email
Daily Management Guide.)
Cisco IronPort Anti-Spam and CASE: an Overview
Cisco IronPort Anti-Spam filtering is based on Context Adaptive Scanning Engine (CASE) , and is
the first anti-spam scanning engine to combine email and web reputation information to:
Eliminate the broadest range of email threats — detect spam, “phishing,” zombie-based attacks, and
other “blended” threats.
Deliver the highest accuracy — anti-spam rules based on email and web reputation from SenderBase
Reputation Service.
Offer ease of use — due to reduced hardware and administrative costs.
Deliver industry leading performance — CASE uses dynamic early exit criteria and off-box network
calculations to deliver breakthrough performance.
Address the needs of international users — Cisco IronPort Anti-Spam is tuned to deliver
industry-leading efficacy world-wide.
OL-25136-01