×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

X-Headers not caught by filters

Unanswered Question
Jun 30th, 2014
User Badges:

Good morning everyone,

I came across a strange issue with usage of X-Headers in content filters and I was unable to find answer to it elsewhere.

All e-mails coming now to my IronPort have an extra X-Header, namely X-Originating-IP. I created a content filter that should log value of this header. The rule has form: Originating_IP: $Header[\"X-Originating-IP\"] (Note: backslashes are added automatically on submission). However when tested, there is no value recorded. I tried to use same form to log other headers, like From:, and everything worked fined. I tried also with other X-Headers, but non of them was logged. I tried escaping dashes in header's name, but this was not successful either (on submission another backslash is added).

So my question is how X-Headers can be used in content filters rules?

Thank you in advance for any tips!

 

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Tommy Foucha Tue, 07/08/2014 - 11:31
User Badges:
  • Cisco Employee,

Permit me a question: All emails coming to my IronPort have an extra X-Header......are these internal emails coming to the IronPort or external emails? Is the Content Filter you are creating Inbound or Outbound? X-Headers are used frequently in Content Filters, I would recommend you also use the TRACE tool to test your configuration.

Actions

This Discussion