DLP under Outgoing Mail Policies Not Available (Ironport C350)

[alimfawad]

Hello Cisco Support Community,

I have an ironport C350 and i am using it as a test on dummy exchange servers before we implement it. I was configuring it's security settings and I came accross a problem where Mail Policies --> Ourgoing Mail Policies --> DLP ynder it, it says Not Available and when i click on not available it says "Not Found and that If you typed the URL directly, make sure that it is enetered correctly."

Can someone please help this is very critical. Also under Mail policies the DLP option doesnt show either

[Ken Stieers · Accepted solution]

Do you have a license for it?  Without a license, it will be unavailable.

Check System Adminstration/Feature Keys.

[Valter Da Costa · Accepted solution]

Click the Unavailable link and that should bring a new page on which you can enable it Globally. If you see there is no option to enable it, then you don't have the feature key, as Ken showed above.  You can ask for a trial. Engage the Sales Team.

[alimfawad]

I noticed you also have a license for outbreak filters can you explain me what that is?

[Ken Stieers]

This is taken from the online help that is on the box.  (BTW, the help files are REALLY GOOD...you should read them...)

Messages designed to steal sensitive information from users or deliver malware to their computers continue to evolve and can slip by traditional anti-virus and anti-spam scanning software. Outbreak Filters act proactively to provide a critical first layer of defense against these new outbreaks. By detecting new outbreaks in real-time and dynamically responding to prevent suspicious traffic from entering the network, Cisco IronPort’s Outbreak Filters feature offers protection until new anti-virus and anti-spam updates are deployed. The Outbreak Filters use Cisco IronPort’s outbreak detection technology and intelligent quarantine system to protect your users.
The Outbreak Filters feature protects your users and your network by gathering information about outbreaks as they occur and using this data to prevent the spread of these outbreaks to your users. Outbreak Filters compares incoming messages with published Outbreak Rules from Cisco Security Intelligence Operations (SIO) to determine if the message is a part of a large-scale virus outbreak or a smaller, non-viral attack. AsyncOS assigns messages that match the Outbreak Rules a threat level that indicates the severity of the message’s threat and compares that threat level to the quarantine and message modfication thresholds you set for your mail policy. Messages that meet or exceed one of those thresholds are quarantined or modified to protect the recipient.
The process of outbreak detection and filtering begins with SenderBase, part of SIO. SenderBase is the world’s largest email and web traffic monitoring system and has a view into approximately 25% of the world’s email traffic. Cisco IronPort uses historical SenderBase data to create a statistical view of normal global traffic patterns. Outbreak Filters depends on the set of rules developed from this data to determine the threat levels of incoming messages.
Outbreak Filters has significant enhancements in features and usability. At a high level the enhancements include, but are not limited to:
•  The increased threat types detected by Cisco Security Intelligence Operations (SIO) and used to create Outbreak Rules to detect non-viral attacks, such as phishing scams and malware distribution, in addition to virus outbreaks.

•  CASE (Context Adaptive Scanning Engine) scanning that scans for URLs to detect non-viral threats, in addition to combining content analysis from Adaptive Rules and Outbreak Rules from SIO to detect outbreaks.

•  Dynamic Quarantine, which re-evaluates messages periodically and auto-releases them from the quarantine based on Outbreak Rule updates.

•  URL rewriting to redirect traffic to potentially harmful websites through the Cisco web security proxy, which either warns users that the website they are attempting to access may be malicious or blocks the website completely.

These feature enhancements are designed to increase the system’s capture rate for outbreaks, provide enhanced visibility into an outbreak, and protect your users’ computers and sensitive information.
Your Cisco IronPort appliance ships with a 30-day evaluation license for the Outbreak Filters feature.

[alimfawad]

How to i buy a license for it my ironport isnt connected to the internet its connected directly through management port to the laptop

[Robert Sherwin · Accepted solution]

You will need to work through your Sales Ops/Account team, or Reseller, in order to purchase the keys as needed.

You can try to contact GLO --->

Please contact our Global Licensing Operations team:

https://tools.cisco.com/SWIFT/LicensingUI/Home

Licensing FAQ

Phone: 1-800-553-2447, opt 3

Their email directly is: licensing@cisco.com

Per the Licensing FAQ --->

Q. How do I order Cisco Licenses?

A. Typically, licenses should be ordered through the customer’s normal point of sale. Contact the local Cisco Sales Representative or your organization’s preferred Cisco Partner for assistance with ordering, part number look up, and/or pricing. To locate nearby Cisco Partners, visit the Partner Locator Tool, located here:

http://tools.cisco.com/WWChannels/LOCATR/jsp/partner_locator.jsp

Also try contacting Cisco Customer Service and/or Presales for additional support in this matter. Customer Service contact information may be found at this site:

http://www.cisco.com/web/ordering/cs_info/or3/o31/ordering_transactional_customer_service_contacts.html

Cisco Presales contact email address is presales@cisco.suth.com; and their phone number is 1-800-553-6387.

[alimfawad]

Thank you soo much for all of that information!! But just curious to run the keys does the ironport has to be connected to the internet anyway? Or does it ever need internet access? Also since ironport c350 is not covered under cisco technical support will i still be able to get license for it?

[Robert Sherwin · Accepted solution]

Keys are assigned based on serial number.  The appliance does not need to be directly connected to an outbound connection in order to assign the key.  If GLO is able to provide a feature key - you are always presented an option to copy/paste the feature key via entering in the string.

You'll be provided w/ a long string - similar to the following:

321ok-ne2MQ-jZVTm-k4EMQ-QB/Wz-12345-12345-l9Fu9-88n7Z-ZZop9-b3ufC-YYivA-ePXX

Once you have this, you can then enter the string on the CLI with "featurekey" -> "activate":

[]> activate

Enter feature key directly, or press Enter to return to featurekey menu.

[]>

...

Or - from the GUI:

System Administration -> Feature Keys

C350 is EOL, and isn't going to be able to get upgraded past 7.6 --- so, it will be up to you as to the next steps you take.  I would strongly suggest opening a conversation with Sales/Reseller - that way you have the best options for what you need, and best options for your $.

[alimfawad]

Would it matter alot if i leave it at 7.6? Also my the serial number is connected to the appliance and appliance is discontued by cisco would i still be able to buy the feature key for dlp?

[Robert Sherwin]

Leaving @ 7.6 - not, that would be fine - no issues with that.

I do belive that the last time to purchase a key would have been Dec 2011 for C350:

http://www.cisco.com/web/ironport/c_x_series_life_cycle.html

- which isn't going to be helpful on getting you the needed DLP feature key. 

But - none-the-less - always contact Sales, get them involved for full information, and possible options as to your hardware and contract needs. 

[alimfawad]

Thats a huge problem then! I really hopw i can work something out with dlp! Thank you for your help I just dont want my company spending more $$$ on an entirely new appliance

[Ken Stieers]

Do you have a VM infrastructure?  The ESA is available as a VM now, and if you're up to date, you can deploy more than one (you pay for licenses per user, not per vm)... so now you don't have to buy new hardware...