Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Email Security Quick-links: ESA Product Support | SMA Product Support | Email Submission and Tracking Portal | Cisco SecurityHub
Current General Deployment (GD) Releases:
ESA: 11.0.0-264 WSA: 10.5.1-296 SMA: 11.0.0-115 Email Plug-in (Reporting): 1.0.1-048 Email Plug-in (Encryption): 1.0.0-036

New Member

Deliver as attachment (RFC822) in virus scanning - what is the effect

Hi all,

I am attempting to understand the ramifications of configuring IronPort virus scanning to deliver a repaired, encrypted, or unscannable message as an RFC 822  attachment to a new message.  What kind of content would be potentially be lost?  We are specifically considering this option for encrypted messages; is there much advantage to that?

Thanks,

- Steve

Everyone's tags (1)
1 ACCEPTED SOLUTION

Accepted Solutions
New Member

Deliver as attachment (RFC822) in virus scanning - what is the e

Hello Steve,

When choosing the "Deliver as Attachment(message/RFC822)" in your Cisco IronPort ESA anti-virus settings, no content will be lost. A complete copy of the message is simply attached to a new notification message.

The only exception is with the 'repaired' anti-virus settings. Regardless of the Action Applied to Message, 'repaired' messages will have the viral content removed. The content that is removed is typically a message attachment or URLs.

The 'encrypted' anti-virus setting only detects password protected or S/MIME messages. As mentioned, you would not lose any content if you chose the "Deliver as Attachment(message/RFC822)" for the 'encrypted' anti-virus settings.

Regards,

-Jerry

3 REPLIES
New Member

Deliver as attachment (RFC822) in virus scanning - what is the e

Hello Steve,

When choosing the "Deliver as Attachment(message/RFC822)" in your Cisco IronPort ESA anti-virus settings, no content will be lost. A complete copy of the message is simply attached to a new notification message.

The only exception is with the 'repaired' anti-virus settings. Regardless of the Action Applied to Message, 'repaired' messages will have the viral content removed. The content that is removed is typically a message attachment or URLs.

The 'encrypted' anti-virus setting only detects password protected or S/MIME messages. As mentioned, you would not lose any content if you chose the "Deliver as Attachment(message/RFC822)" for the 'encrypted' anti-virus settings.

Regards,

-Jerry

New Member

Deliver as attachment (RFC822) in virus scanning - what is the e

Hi Jerry,

Thanks for the explanation!

Best,

- Steve

New Member

I would like to know if we

I would like to know if we disable this rule, what else will be affected?

1022
Views
0
Helpful
3
Replies