Email Security with Cisco IronPort

By Chris Porter
Published Apr 9, 2012 by Cisco Press.

eBook

Your Price: $51.19
List Price: $63.99
About Watermarked eBooks

This PDF will be accessible from your Account page after purchase and requires PDF reading software, such as Acrobat® Reader®.

The eBook requires no passwords or activation to read. We customize your eBook by discreetly watermarking it with your name, making it uniquely yours.

Watermarked eBook FAQ

Add to cart

Description

Sample Content

Updates

Copyright 2012
Dimensions: 7-3/8" x 9-1/8"
Pages: 576
Edition: 1st

eBook
ISBN-10: 0-13-273070-7
ISBN-13: 978-0-13-273070-9

Email Security with Cisco IronPort thoroughly illuminates the security and performance challenges associated with today’s messaging environments and shows you how to systematically anticipate and respond to them using Cisco’s IronPort Email Security Appliance (ESA). Going far beyond any IronPort user guide, leading Cisco expert Chris Porter shows you how to use IronPort to construct a robust, secure, high-performance email architecture that can resist future attacks.

Email Security with Cisco IronPortpresents specific, proven architecture recommendations for deploying IronPort ESAs in diverse environments to optimize reliability and automatically handle failure. The author offers specific recipes for solving a wide range of messaging security problems, and he demonstrates how to use both basic and advanced features-–including several hidden and undocumented commands.

The author addresses issues ranging from directory integration to performance monitoring and optimization, and he offers powerful insights into often-ignored email security issues, such as preventing “bounce blowback.” Throughout, he illustrates his solutions with detailed examples demonstrating how to control ESA configuration through each available interface.

Chris Porter,Technical Solutions Architect at Cisco, focuses on the technical aspects of Cisco IronPort customer engagements. He has more than 12 years of experience in applications, computing, and security in finance, government, Fortune^® 1000, entertainment, and higher education markets.

·Understand how the Cisco IronPort ESA addresses the key challenges of email security

·Select the best network deployment model for your environment, and walk through successful installation and configuration

·Configure and optimize Cisco IronPort ESA’s powerful security, message, and content filtering

·Understand the email pipeline so you can take full advantage of it–and troubleshoot problems if they occur

·Efficiently control Cisco IronPort ESA through its Web User Interface (WUI) and command-line interface (CLI)

·Implement reporting, monitoring, logging, and file management

·Integrate Cisco IronPort ESA and your mail policies with LDAP directories such as Microsoft Active Directory

·Automate and simplify email security administration

·Deploy multiple Cisco IronPort ESAs and advanced network configurations

·Prepare for emerging shifts in enterprise email usage and new security challenges

This security book is part of the Cisco Press^® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks.

Introduction xxiii

Chapter 1 Introduction to Email Security 1

Overview of Cisco IronPort Email Security Appliance (ESA) 1

AsyncOS 3

Security Management Appliances (SMA) 3

History of AsyncOS Versions 4

Software Features 5

Email Security Landscape 6

Email Spam 6

Viruses and Malware 7

Protecting Intellectual Property and Preventing Data Loss 8

Other Email Security Threats 9

Simple Mail Transfer Protocol (SMTP) 9

SMTP Commands 14

ESMTP Service Extensions 15

SMTP Message Headers and Body 16

Envelope Sender and Recipients 17

Transmitting Binary Data 18

MIME Types 20

Character Sets 21

Domain Name Service (DNS) and DNS MX Records in IPv4 and IPv6 22

Message Transfer Agents (MTA) 23

Abuse of SMTP 24

Relaying Mail and Open Relays 24

Bounces, Bounce Storms, and Misdirected Bounces 25

Directory Harvest Attacks 26

Summary 27

Chapter 2 ESA Product Basics 29

Hardware Overview 29

2U Enterprise Models 30

1U Enterprise Models 31

Selecting a Model 31

Basic Setup via the WUI System Setup Wizard 31

Connecting to the ESA for the First Time 31

Running the System Setup Wizard 32

Reconnecting to the WUI 38

LDAP Wizard and Next Steps 39

Examining the Basic Configuration 41

Next Steps 41

Setup Summary 42

Networking Deployment Models 43

Interfaces, Routing, and Virtual Gateways 43

Single Versus Multinetwork Deployment 47

Routing on Multinetwork Deployments 48

DNS Concerns 49

Firewall Rules 50

Securing Network Interfaces 51

Security Filtering Features 52

SenderBase and Reputation Filters 53

IronPort Anti-Spam 54

Antivirus Features 55

Summary 58

Chapter 3 ESA Email Pipeline 59

ESA Pipeline 59

Listeners 61

Host Access Table (HAT) and Reputation Filters 63

Rate Limiting with Mail Flow Policies 65

DNS and Envelope Checks 67

Sender Authentication 67

Recipient Access Table and LDAP Accept 67

Recipient and Sender Manipulation 70

Default Domain, Domain Map, and Aliases 70

Masquerading 71

LDAP Operations 72

LDAP Accept 72

LDAP Routing and Masquerading 73

Groups 73

Work Queue and Filtering Engines 73

Work Queue Overview 74

Incoming and Outgoing Mail Policies 74

Message Filters 75

Anti-Spam Engine 75

Antivirus Engines 76

Content Filtering 77

Virus Outbreak Filters 78

DLP and Encryption 78

Delivery of Messages 79

Selecting the Delivery Interface (Virtual Gateways) 80

Destination Controls 81

Global Unsubscribe 81

SMTP Routes 82

Selecting Bounce Profiles 83

Handling Delivery Errors with Bounce Profiles 84

Final Disposition 85

Summary 85

Chapter 4 ESA Web User Interface 87

Overview 87

Connecting to the WUI 87

WUI Tour 88

Monitor Menu 88

Overview 89

Incoming Mail 89

Outgoing Destinations 90

Outgoing Senders 90

Delivery Status 90

Internal Users 90

DLP Incidents 91

Content Filters 91

Outbreak Filters 91

Virus Types 92

TLS Connections 92

System Capacity 92

System Status 92

Scheduled Reports 93

Archived Reports 93

Quarantines 93

Message Tracking 94

Mail Policies Menu 94

Incoming Mail Policies 95

Incoming Content Filters 95

Outgoing Mail Policies 96

Outgoing Content Filters 96

Host Access Table (HAT) Overview 96

Mail Flow Policies 97

Exception Table 97

Recipient Access Table (RAT) 97

Destination Controls 97

Bounce Verification 98

DLP Policy Manager 98

Domain Profiles 99

Signing Keys 99

Text Resources 99

Dictionaries 99

Security Services Menu 100

Anti-Spam 100

Antivirus 101

RSA Email DLP 101

IronPort Email Encryption 101

IronPort Image Analysis 101

Outbreak Filters 102

SenderBase 102

Reporting 103

Message Tracking 103

External Spam Quarantine 103

Service Updates 103

Network Menu 104

IP Interfaces 105

Listeners 105

SMTP Routes 105

DNS 106

Routing 106

SMTP Call-Ahead 106

Bounce Profiles 106

SMTP Authentication 107

Incoming Relays 107

Certificates 107

System Administration Menu 108

Trace Tool 108

Alerts 109

LDAP 109

Log Subscriptions 109

Return Addresses 110

Users 110

User Roles 111

Network Access 111

Time Zone and Time Settings 111

Configuration File 112

Feature Keys and Feature Key Settings 112

Shutdown/Suspend 112

System Upgrade 113

System Setup Wizard 113

Next Steps 114

Options Menu 114

Active Sessions 115

Change Password 115

Log Out 115

Help and Support Menu 115

Online Help 116

Support Portal 116

New in This Release 116

Open a Support Case 117

Remote Access 117

Packet Capture 118

WUI with Centralized Management 118

Selecting Cluster Mode 119

Modify CM Options in the WUI 121

Modifying Cluster Settings 121

Other WUI Features 122

Variable WUI Appearance 122

Committing Changes 123

Summary 123

Chapter 5 Command-Line Interface 125

Overview of the ESA Command-Line Interface 125

Using SSH or Telnet to Access the CLI 125

PuTTY on Microsoft Windows 127

Simple CLI Examples 129

Getting Help 132

Committing Configuration Changes 133

Keeping the ESA CLI Secure 134

SSH Options on the ESA 135

Creating and Using SSH Keys for Authentication 136

Restricting Access to SSH 140

ESA Setup Using the CLI 141

Basics of Setup 142

Next Setup Steps 142

Commands in Depth 146

Troubleshooting Example 146

Status and Performance Commands 146

Command Listing by Functional Area 156

Mail Delivery Troubleshooting 156

Network Troubleshooting 156

Controlling Services 157

Performance and Statistics 158

Logging and Log Searches 159

Queue Management and Viewing 160

Configuration File Management 161

AsyncOS Version Management 162

Configuration Testing Commands 163

Support Related Commands 163

General Administration Commands 165

Miscellaneous Commands 166

Configuration Listing by Functional Area 167

Network Setup 167

Listeners 168

Mail Routing and Delivery 175

Policy and Filtering 176

Managing Users and Alerts 177

Configuring Global Engine and Services Options 177

CLI-Only Tables 179

Configuration for External Communication 179

Miscellaneous 180

Batch Commands 181

Hidden/Undocumented Commands 183

Summary 186

Chapter 6 Additional Management Services 187

The Need for Additional Protocol Support 187

Simple Network Management Protocol (SNMP) 188

Enabling SNMP 188

SNMP Security 189

Enterprise MIBs 189

Other MIBs 190

Monitoring Recommendations 191

Working with the ESA Filesystem 193

ESA Logging 196

ESA Subsystem Logs 196

Administrative and Auditing Logs 197

Email Activity Logs 198

Debugging Logs 199

Archive Logs 201

Creating a Log Subscription 202

Logging Recommendations 202

Transferring Logs for Permanent Storage 203

HTTP to the ESA 204

FTP to the ESA 204

FTP to a Remote Server 204

SCP to a Remote Server 205

Syslog Transfer 205

Understanding IronPort Text Mail Logs 206

Message Events 206

Lifecycle of a Message in the Log 207

Tracing Message History 209

Parsing Message Events 211

A Practical Example of Log Parsing 212

Using Custom Log Entries 215

Summary 217

Chapter 7 Directories and Policies 219

Directory Integration 219

The Need for Directory Integration 220

Security Concerns 220

Brief LDAP Overview 221

LDAP Setup on ESA 223

Advanced Profile Settings 225

Basic Query Types 226

Recipient Validation with LDAP 227

Recipient Routing with LDAP 229

Sender Masquerading 230

Group Queries 231

Authentication Queries 233

AD Specifics 233

Testing LDAP Queries 234

Advanced LDAP Queries 234

Troubleshooting LDAP 239

Incoming and Outgoing Mail Policies 241

Group-Based Policies 241

Group Matches in Filters 241

Other LDAP Techniques 242

Using Group Queries for Routing 242

Per-Recipient Routing with AD and Exchange 244

Using Group Queries for Recipient and Sender Validation 244

Summary 245

Chapter 8 Security Filtering 247

Overview 247

The Criminal Ecosystem 248

Reputation Filters and SenderBase Reputation Scores 248

Enabling Reputation Filters 249

Reputation Scores 250

Connection Actions 250

HAT Policy Recommendations 250

IronPort Anti-Spam (IPAS) 251

Enabling IPAS 252

IPAS Verdicts 253

IPAS Actions 254

Content Filters and IPAS 255

Recommended Anti-Spam Settings 257

Spam Thresholds 257

Actions for the Bold 258

Actions for the Middle-of-the-Road 258

Actions for the Conservative 258

Outgoing Anti-Spam Scanning 259

Sophos and McAfee Antivirus (AV) 259

Enabling AV 260

AV Verdicts 262

AV Actions 263

AV Notifications 263

Content Filters and AV 264

IronPort Outbreak Filters (OF) 266

Enabling OF 267

OF Verdicts 267

OF Actions 268

Message Modification 269

Content Filters and OF 270

Recommended AV Settings 270

Incoming AV Recommendations 271

Outgoing AV Recommendations 272

Using Content Filters for Security 273

Attachment Conditions and Actions 273

Filtering Bad Senders 276

Filtering Subject or Body 277

Summary 278

Chapter 9 Automating Tasks 279

Administering ESA from Outside Servers 279

CLI Automation Examples 280

SSH Clients 281

Expect 281

Perl 283

CLI Automation from Microsoft Windows Servers 285

WUI Automation Examples 287

Polling Data from the ESA 287

Retrieving XML Data Pages 287

Using XML Export for Monitoring 290

Pushing Data to the ESA and Making Configuration Changes 292

Changing Configuration Settings Using the CLI 293

Committing Changes Using the CLI 295

Changing Configuration Settings Using the WUI 296

Committing Changes Using the WUI 298

Retrieving Reporting Data from the WUI 298

Data Export URLs 299

Submit Errata

Cisco Press Promotional Mailings & Special Offers

I would like to receive exclusive offers and hear about products from Cisco Press and its family of brands. I can unsubscribe at any time.

Privacy Notice

Overview

Pearson Education, Inc., 221 River Street, Hoboken, New Jersey 07030, (Pearson) presents this site to provide information about Cisco Press products and services that can be purchased through this site.

This privacy notice provides an overview of our commitment to privacy and describes how we collect, protect, use and share personal information collected through this site. Please note that other Pearson websites and online products and services have their own separate privacy policies.

Collection and Use of Information

To conduct business and deliver products and services, Pearson collects and uses personal information in several ways in connection with this site, including:

Questions and Inquiries

For inquiries and questions, we collect the inquiry or question, together with name, contact details (email address, phone number and mailing address) and any other additional information voluntarily submitted to us through a Contact Us form or an email. We use this information to address the inquiry and respond to the question.

Online Store

For orders and purchases placed through our online store on this site, we collect order details, name, institution name and address (if applicable), email address, phone number, shipping and billing addresses, credit/debit card information, shipping options and any instructions. We use this information to complete transactions, fulfill orders, communicate with individuals placing orders or visiting the online store, and for related purposes.

Surveys

Pearson may offer opportunities to provide feedback or participate in surveys, including surveys evaluating Pearson products, services or sites. Participation is voluntary. Pearson collects information requested in the survey questions and uses the information to evaluate, support, maintain and improve products, services or sites; develop new products and services; conduct educational research; and for other purposes specified in the survey.

Contests and Drawings

Occasionally, we may sponsor a contest or drawing. Participation is optional. Pearson collects name, contact information and other information specified on the entry form for the contest or drawing to conduct the contest or drawing. Pearson may collect additional personal information from the winners of a contest or drawing in order to award the prize and for tax reporting purposes, as required by law.

Newsletters

If you have elected to receive email newsletters or promotional mailings and special offers but want to unsubscribe, simply email information@ciscopress.com.

Service Announcements

On rare occasions it is necessary to send out a strictly service related announcement. For instance, if our service is temporarily suspended for maintenance we might send users an email. Generally, users may not opt-out of these communications, though they can deactivate their account information. However, these communications are not promotional in nature.

Customer Service

We communicate with users on a regular basis to provide requested services and in regard to issues relating to their account we reply via email or phone in accordance with the users' wishes when a user submits their information through our Contact Us form.

Other Collection and Use of Information

Application and System Logs

Pearson automatically collects log data to help ensure the delivery, availability and security of this site. Log data may include technical information about how a user or visitor connected to this site, such as browser type, type of computer/device, operating system, internet service provider and IP address. We use this information for support purposes and to monitor the health of the site, identify problems, improve service, detect unauthorized access and fraudulent activity, prevent and respond to security incidents and appropriately scale computing resources.

Web Analytics

Pearson may use third party web trend analytical services, including Google Analytics, to collect visitor information, such as IP addresses, browser types, referring pages, pages visited and time spent on a particular site. While these analytical services collect and report information on an anonymous basis, they may use cookies to gather web trend information. The information gathered may enable Pearson (but not the third party web trend services) to link information with application and system log data. Pearson uses this information for system administration and to identify problems, improve service, detect unauthorized access and fraudulent activity, prevent and respond to security incidents, appropriately scale computing resources and otherwise support and deliver this site and its services.

Cookies and Related Technologies

This site uses cookies and similar technologies to personalize content, measure traffic patterns, control security, track use and access of information on this site, and provide interest-based messages and advertising. Users can manage and block the use of cookies through their browser. Disabling or blocking certain cookies may limit the functionality of this site.

Do Not Track

This site currently does not respond to Do Not Track signals.

Security

Pearson uses appropriate physical, administrative and technical security measures to protect personal information from unauthorized access, use and disclosure.

Children

This site is not directed to children under the age of 13.

Marketing

Pearson may send or direct marketing communications to users, provided that

Pearson will not use personal information collected or processed as a K-12 school service provider for the purpose of directed or targeted advertising.
Such marketing is consistent with applicable law and Pearson's legal obligations.
Pearson will not knowingly direct or send marketing communications to an individual who has expressed a preference not to receive marketing.
Where required by applicable law, express or implied consent to marketing exists and has not been withdrawn.

Pearson may provide personal information to a third party service provider on a restricted basis to provide marketing solely on behalf of Pearson or an affiliate or customer for whom Pearson is a service provider. Marketing preferences may be changed at any time.

Correcting/Updating Personal Information

If a user's personally identifiable information changes (such as your postal address or email address), we provide a way to correct or update that user's personal data provided to us. This can be done on the Account page. If a user no longer desires our service and desires to delete his or her account, please contact us at customer-service@informit.com and we will process the deletion of a user's account.

Choice/Opt-out

Users can always make an informed choice as to whether they should proceed with certain services offered by Cisco Press. If you choose to remove yourself from our mailing list(s) simply visit the following page and uncheck any communication you no longer want to receive: www.ciscopress.com/u.aspx.

Sale of Personal Information

Pearson does not rent or sell personal information in exchange for any payment of money.

While Pearson does not sell personal information, as defined in Nevada law, Nevada residents may email a request for no sale of their personal information to NevadaDesignatedRequest@pearson.com.

Supplemental Privacy Statement for California Residents

California residents should read our Supplemental privacy statement for California residents in conjunction with this Privacy Notice. The Supplemental privacy statement for California residents explains Pearson's commitment to comply with California law and applies to personal information of California residents collected in connection with this site and the Services.

Sharing and Disclosure

Pearson may disclose personal information, as follows:

As required by law.
With the consent of the individual (or their parent, if the individual is a minor)
In response to a subpoena, court order or legal process, to the extent permitted or required by law
To protect the security and safety of individuals, data, assets and systems, consistent with applicable law
In connection the sale, joint venture or other transfer of some or all of its company or assets, subject to the provisions of this Privacy Notice
To investigate or address actual or suspected fraud or other illegal activities
To exercise its legal rights, including enforcement of the Terms of Use for this site or another contract
To affiliated Pearson companies and other companies and organizations who perform work for Pearson and are obligated to protect the privacy of personal information consistent with this Privacy Notice
To a school, organization, company or government agency, where Pearson collects or processes the personal information in a school setting or on behalf of such organization, company or government agency.

Links

This web site contains links to other sites. Please be aware that we are not responsible for the privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of each and every web site that collects Personal Information. This privacy statement applies solely to information collected by this web site.

Requests and Contact

Please contact us about this Privacy Notice or if you have any requests or questions relating to the privacy of your personal information.

Changes to this Privacy Notice

We may revise this Privacy Notice through an updated posting. We will identify the effective date of the revision in the posting. Often, updates are made to provide greater clarity or to comply with changes in regulatory requirements. If the updates involve material changes to the collection, protection, use or disclosure of Personal Information, Pearson will provide notice of the change through a conspicuous notice on this site or other appropriate way. Continued use of the site after the effective date of a posted revision evidences acceptance. Please contact us if you have questions or concerns about the Privacy Notice or any objection to any revisions.

Last Update: November 17, 2020

Email Address