Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Email Security Quick-links: ESA Product Support | SMA Product Support | Email Submission and Tracking Portal | Cisco SecurityHub
Current General Deployment (GD) Releases:
ESA: 11.0.0-264 WSA: 10.5.1-296 SMA: 11.0.0-115 Email Plug-in (Reporting): 1.0.1-048 Email Plug-in (Encryption): 1.0.0-036

match Content-Type: multipart/alternative;

Hello,

we´re doing a 30 Day trial and we´re trying to migrate functions out of our Surfcontrol EF to 2 Ironport C-150.

add_txt_footer:
[Sender is stadthalle.com] and
["Content-Type: multipart/alternative;" is not in Header] and
["aw:, re:, fwd:, wg:" is not in Subject] and
["7999979" is not in Body] and
[Message < 50kBytes] then add txtfooter

add_html_footer:
[Sender is stadthalle.com] and
["Content-Type: multipart/alternative;" is in Header] and
["aw:, re:, fwd:, wg:" is not in Subject] and
["7999979" is not in Body] and
[Message < 50kBytes] then add htmlfooter

- how can we do that?

Current situation:
add_txt_footer: if (mail-from == "stadthalle.com$") AND (header("Content-Type:") != "multipart/alternative;") AND (body-size < 50000) { add-footer("txtfooter"); }
allways matches, so RTF and HTML Mails dont get the html footer

</PRE>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>
<font face="Trebuchet MS"><strong>MASTERS OF DIRT:</strong>
<br>
21. + 22. Februar 2009 / Wiener Stadthalle
<br>
INFO: <a href="http://www.stadthalle.com">http://www.stadthalle.com</a> 01 / 79 999 79 </font>
</body>
</html>
<PRE>

any suggestion welcome!

Klemens

2 REPLIES
Cisco Employee

Re: match Content-Type: multipart/alternative;

Hi Klemens,

I made some slight modifications to your posted filter, and tried out my versions on an IronPort, which good results.

There are other options you will probably want to add, such as including the name of the outgoing listener to keep messages from being "double-footered".
This is covered in a Knowledge Base article already: http://tinyurl.com/5gaj24

I created the following as message filters from the CLI.

addtxtfooter:
if(mail-from == "example.com$") AND (header("Content-Type") != "multipart/alternative") AND (body-size < 50000)
{
add-footer("txtfooter");
}


addhtmlfooter:
if(mail-from == "example.com$") AND (header("Content-Type") == "multipart/alternative") AND (body-size < 50000)
{
add-footer("htmlfooter");
}

Hope that helps.

-whardison

Re: match Content-Type: multipart/alternative;

Hello whardison!

we replaced the outgoing Filters with a CLI Filter:
eventinfo:

if ((mail-from == "mydomain.com$") and (not(body-dictionary-match("words", 1))) and (body-size < 50000))
{
if (header("Content-Type") != "multipart/alternative;")
{ add-footer("txtfooter"); }
else
{ add-footer("htmlfooter"); }
}

the words dictionary contains the following items:
aw:, fwd:, wg:, re:, Converted from text\0x2frtf format

the last entry is needed for some special Outlook rtf circumstances, where the Exchange 2003 is converting the RTF to text due it is mutlipart/alternative. - No Footer

For a new Problem "Group Matching LDAP" i created a new topic 1199

165
Views
0
Helpful
2
Replies