IronPort - Configuration Guide - AsyncOS 7.6.1

Chapter 17 The Cisco IronPort M-Series Security Management Appliance
OL-25136-01
The Cisco IronPort M-Series appliance accepts mail for quarantining from the IP addresses specified in
the Cisco IronPort Spam Quarantine settings. To configure the local quarantine on the Cisco IronPort
M-Series appliance see the Cisco IronPort AsyncOS for Security Management User Guide . Note that the
local quarantine on the Cisco IronPort M-Series appliance is referred to as an external quarantine by the
other Cisco IronPort appliances sending mail to it.
Mail released by the Cisco IronPort M-Series appliance is delivered to the primary and secondary hosts
(Cisco IronPort appliance or other groupware host) as defined in the Spam Quarantine Settings (see the
Cisco IronPort AsyncOS for Security Management User Guide ). Therefore, regardless of the number of
Cisco IronPort appliances delivering mail to the Cisco IronPort M-Series appliance, all released mail,
notifications, and alerts are sent to a single host (groupware or Cisco IronPort appliance). Take care to
not overburden the primary host for delivery from the Cisco IronPort M-Series appliance.
Configuring Monitoring Services
Before you can use a Security Management appliance for centralized reporting and centralized tracking
or as an external Cisco IronPort Spam Quarantine, you need to configure the monitoring services on the
Email Security appliances.
When you configure the monitoring services on the Email Security appliances, you must also enable the
services on the Security Management appliance. For more information, see the Cisco IronPort AsyncOS
for Security Management User Guide .
You use monitoring services to run reports on email traffic, track message routing, and deliver suspect
and spam messages to an external Cisco IronPort Spam Quarantine. You can configure one or more of
the following services:
Centralized Reporting. For more information, see Configuring an Email Security Appliance to Use
Centralized Reporting, page 17-3.
Centralized Tracking. For more information, see Configuring an Email Security Appliance to Use
Centralized Tracking, page 17-4.
Cisco IronPort Spam Quarantine. For more information, see Configuring an Email Security
Appliance to Use an External Cisco IronPort Spam Quarantine, page 17-5.
Configuring an Email Security Appliance to Use Centralized Reporting
You can configure centralized reporting on an Email Security appliance at any time. Typically, you
configure centralized reporting after you enable the feature on a Security Management appliance.
Note Before enabling centralized reporting, ensure that sufficient disk space is allocated to that service.
Step 1 Click Security Services > Reporting.
The Reporting Service Settings page is displayed.
Cisco IronPort AsyncOS 7.6 for Email Configuration Guide
17-3