ByPass Content Filtering

VancePrice · ‎10-31-2008

We have several content filters setup on an incoming policy. Profanity, Image Sanning and account numbers.

We get a lot of news letters that are quarantined by these filters (mainly profanity).

I am compiling a list of sender addresses in a dictionary. How can I set this list of senders to bypass the content filtering?

kluu_ironport · ‎10-31-2008

The easiest way to do it is to create a new "incoming mail policy" that resides above your "Default" policy.

- Label it "Skip inbound Content Filtering" for example.

- Add the sender's email addresses or domains to this new incoming mail policy.

- Then, for this policy, make the anti-spam and anti-virus use the Default and turn off or disable some content filters that you don't want to have applied to these senders.

VancePrice · ‎10-31-2008

I think this would work excpet that the policy also checks if recipient is a member of a LDAP group.

That is why I was thinking of using a dictionary.
Let say the content filter is If sender is in this dictionary then somehow bypass the remaining content filters.

Is this possible?

kluu_ironport · ‎10-31-2008

Yes, just make the "Bypass-All-Content-Filters" rule all the way at the top of your content filters.

The IF condition on your content filter is to compare a list of sender domains or email addresses from a dictionary file.

The ACTION would be to deliver()

The deliver() is a final action and will stop processing any further content filters. Make sure you place this content filter all the way at the top or where ever you want to tell it to not process any further.

VancePrice · ‎10-31-2008

So, it should only apply the action if the condition is true.
If false it will skip the action and go to the next content filter. Correct?

Sorry for being such a noob. We just got IronPort and on a 30 trial.

I am loving it so far. It does a great job.

kluu_ironport · ‎10-31-2008

Correct, if the message doesn't meet the IF condition, then the ACTION will not be applied and the message will continue evaluating the other content filters. It's a top-down design, so order of precedence is very important. The deliver() action, like the drop() action are final actions and allows you to stop processing further content filters.

Congrats on the new appliance. I'm sure your employees will see a noticable decrease in spam they normally get.

By the way, the online support portal has additional resources that you can benefit from. The Support portal knowledge base and the Email documentation section that goes over the Advanced stuff like LDAP. (joy joy)