Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Email Security Quick-links: ESA Product Support | SMA Product Support | Email Submission and Tracking Portal | Cisco SecurityHub
Current General Deployment (GD) Releases:
ESA: 11.0.0-264 WSA: 10.5.1-296 SMA: 11.0.0-115 Email Plug-in (Reporting): 1.0.1-048 Email Plug-in (Encryption): 1.0.0-036

New Member

Blocking attachments of file type .icl


We would like to configure our IronPort server to drop attachments of type iCal (.icl). However I can not find that file type under file types in the Attachment file info File type is. Is there some way to add a custom file type in IronPort? Or will it work with adding a filename contains *.icl type of condition?

In the log it shows the attachment as a name of meeting.icl but I dont know if all the iCal meetings has that name or if that meeting simply was named that way.


Blocking attachments of file type .icl

Hello Andreas,

easiest way would be matching to the file name with the file name  action in message or content filter (I suppose you'd not need a  condition for that, because an action drop-attachment-by-filename is  already a perfect fit, and makes the filter easier). 

In theory, there is also a message filter condition  called "attachment-binary-contains", which let's you enter a binary  pattern, i.e. a magic number for a given file type. However, this  condition has no corresponding action to drop that attachment, so it  would be only useful to quarantine or drop a whole message.

Hope that helps,