Attachment >10MB Filter

Unanswered Question
Sep 11th, 2008

Hi Gurus,

Just wanna ask if someone here already implemented this kind of setup..

if message attachment is greater than 10MB, ironport will drop the attachment then send notification to both sender and recipient..

anyone ?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
whardiso Thu, 09/11/2008 - 13:15


You can do this by creating an incoming content filter and applying it to your incoming mail policy. You would most likely want this to be ordered '1', to avoid processing the email through other filters before the attaclment if stripped.

First, create a template under 'Mail Policies -> Text Resources' of type 'Notification Template'. This will be the message sent to the sender and recipient explaining why the attachment was stripped.

Then, create the Incoming Content Filter. A Condition is not needed if you want this filter to check all messages for their size.
If you wish to restrict the filter to certain other conditions (sender, subject, etc..) , then you can add a Condition as needed.

Add the first Action: 'Strip Attachment by File Info -> File Size if Greater than '. Keep in mind that the file size it is asking for is in *bytes*, so convert the size accordingly.

Add a second Action: 'Notify'. There are two checkboxes on the Notify screen, 'Sender' and 'Recipient'; check both. Select your template you created earlier in the drop-down box labeled 'Use Template'.

Submit and commit your changes.

Browse to 'Mail Policies -> Incoming Mail Policies', and apply the new content filter to your Incoming Mail Policy.

Submit and commit your changes.


angfeglandagan Fri, 09/12/2008 - 13:23


Already done problem was...when i made some tests..

i got the notification message and the attachment as well.. was not stripped from mail.,

Knuto0815 Fri, 09/12/2008 - 14:02

Why not taking message filters? Maybe i am a bit slow witted but wouldn't it be better stripping off the attachments that are too large as early as possible. So they won't run through the AV and stuff and would boost the performance a little. Or am i off the track?

angfeglandagan Wed, 09/17/2008 - 03:16

Yup, i tell the ironport on the content filter action to STRIP the attachment by INFO then notify both sender/recipient...that the attachment was stripped but the message body is still there ...

any tips?


This Discussion