cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1070
Views
0
Helpful
4
Replies

Attachment >10MB Filter

angfeglandagan
Level 1
Level 1

Hi Gurus,

Just wanna ask if someone here already implemented this kind of setup..

if message attachment is greater than 10MB, ironport will drop the attachment then send notification to both sender and recipient..


anyone ?

4 Replies 4

Douglas Hardison
Cisco Employee
Cisco Employee

Hi,

You can do this by creating an incoming content filter and applying it to your incoming mail policy. You would most likely want this to be ordered '1', to avoid processing the email through other filters before the attaclment if stripped.

First, create a template under 'Mail Policies -> Text Resources' of type 'Notification Template'. This will be the message sent to the sender and recipient explaining why the attachment was stripped.

Then, create the Incoming Content Filter. A Condition is not needed if you want this filter to check all messages for their size.
If you wish to restrict the filter to certain other conditions (sender, subject, etc..) , then you can add a Condition as needed.

Add the first Action: 'Strip Attachment by File Info -> File Size if Greater than '. Keep in mind that the file size it is asking for is in *bytes*, so convert the size accordingly.

Add a second Action: 'Notify'. There are two checkboxes on the Notify screen, 'Sender' and 'Recipient'; check both. Select your template you created earlier in the drop-down box labeled 'Use Template'.

Submit and commit your changes.

Browse to 'Mail Policies -> Incoming Mail Policies', and apply the new content filter to your Incoming Mail Policy.

Submit and commit your changes.


-whardison

angfeglandagan
Level 1
Level 1

Hi,

Already done that....before...my problem was...when i made some tests..

i got the notification message and the attachment as well..

meaning...it was not stripped from mail.,

Knuto0815
Level 1
Level 1

Why not taking message filters? Maybe i am a bit slow witted but wouldn't it be better stripping off the attachments that are too large as early as possible. So they won't run through the AV and stuff and would boost the performance a little. Or am i off the track?

angfeglandagan
Level 1
Level 1

Yup, i tell the ironport on the content filter action to STRIP the attachment by INFO then notify both sender/recipient...that the attachment was stripped but the message body is still there ...


any tips?

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: