cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
4430
Views
0
Helpful
7
Replies

Ironport C350's in cluster, have to search both to find email's to release

parnelllutz
Level 1
Level 1

I have two c350's in Cluster on os 7.3. When a user asks to have a email released (quarantined) I have to search both units to find it. For example it could be on ironport01 or ironport02. There is a spam search, but these are not spam emails, these are ones that have been quarantined and I released them, for example audio file attachments. If this is just the way it is, thats all I need to know. Maybe in cluster they have to be the same name?

Thanks

7 Replies 7

viahmed
Cisco Employee
Cisco Employee

Hi Parnell,

The quarantines other than spam quarantine (e.g. policy quarantine) are always on the same box. You can only configure spam quarantine in centralized option.

Hope this helps!

Regards,

Viquar

CSE

  Ah so I have 2 ironports, in cluster, but quarantined email will go to only 1 of them. Which means I may need to search both to find the 1 email I am looking for. I figured in cluster mode there may of been a way to search that included both appliances. 

Hello Parnell,

clustering on Cisco IronPort means to synchronise the configuration of two or more appliances, while  their features, logs, reporting, quarantines etc still run independendly on each appliance. To maintain these features centralized as well, you'd need an SMA (M-series), which provides centralized tracking and reporting for all appliances.

Regards,

Andreas

Thanks Andreas,

We do have a M650 device, but like you state, it runs centralized tracking and spam, but is not able to search the stored emails on the 350's...I guess that has just confirmed my own theory, that I will still need to search both c350 to find emails to release.

I appreciate the input to clairify my question.

Hi Parnell,

If you have a management device (M650) than you need to enable the external spam quarantine on C-series boxes to take advantage of single quarantine box. All the quarantined messages from both C series will be pushed to your M650 where you can release and manage them easily.

Please check and enable the external spam quarantine on C series, GUI-->Security Services-->External Spam Quarantine.

I will recommend you to open a support request with us to be safe side if you are not familiar of the product and need further guidance.

Thanks,

Viquar

Well the thing is, the emails I am referring to aren't spam. They are just emails with attachments that get quarantined and we have our clients request they be released. So from what I read it is a separate quaratine. The spam quaratine is already enabled and I can search it, but it finds spam emails, which I am not looking for and the emails I need to release are not located in.

Greetings Parnell,  Are these messages already in Policy Quarantine? If yes, then you as an administrator can only release them for the user. In future for new emails, if you want users to release them the messages when hit by a content filter, you can divert the messages using a content or message filter to IronPort Spam Quarantine.   Here are the KB articles you can refer to for this information:  Can a Content Filter divert messages to the IronPort Spam Quarantine? http://tinyurl.com/coebj3  Can a Message Filter divert messages to the IronPort Spam Quarantine? http://tinyurl.com/s2eql  Hope this information helps. Please let us know if you have any questions.   Thanks, Jyothi Gandla Customer Support Engineer

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: