RE: Feature Pack 1 RELEASED!
- From: "Edward Sullivan" <esullivan@xxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Wed, 8 Jan 2003 09:03:06 -0600
Jim, here was my original message to the group. More below:
--------
"We are running ISA and IIS SMTP on our perimeter email screener, and using the
SMTP Filter to screen for:
* Attachment types (.exe, .pif, .com, .vbs, .bat, and .scr)
* Domains which we receive spam from (about 100 in the list)
* Spam keywords (126 keywords in the list)
Any message that meets SMTP filter criteria is forwarded to a spam box on our
primary Exchange Server.
This server is not our firewall - we are only using ISA for the email filtering
functionality. The server hardware is a Dell 2550 with 512MB of RAM, and a 2
GHZ XEON Processor. Dual NIC's, of course. To me, this seems like a well-sized
server for the application.
My question is this - I have noticed that certain keywords are not being
filtered, and that messages that contain keywords are not being forwarded to
our spam address, and are instead making it to our users. Is there an effective
limit to the number of keywords ISA can handle, or is there a misconfiguration
somewhere? Has anyone else seen this behavior, and found a way to correct it? A
bug in ISA perhaps? (Heaven forbid!)"
--------
After working with Tom for awhile, both he and I (mostly he) determined where
in the registry the keyword, attachment type, and domain keywords are stored in
the registry. See this Q for details, and make sure you use REGEDIT and not
REGEDT32 to view the registry keys:
http://support.microsoft.com/default.aspx?scid=kb;en-us;305012
Tom's theory was that there was a limit to the max size that the registry key
could store, and once this max size was reached it might be causing the domain
and keyword filters to sporadically fail. Numerous tests on my part yielded
nothing promising, for example "freddysfabulousfinds.com" would consistently
fail both as a domain and a filter keyword even after it was removed, re-added,
coaxed, cursed at, etc.
I have yet to determine if FP1 has corrected this issues, but initial tests are
promising. ("freddysfabulousfinds.com" is no longer failing when tested as a
SMTP filter keyword.) Once I know conclusively if FP1 fixed the previous
problems with the SMTP filter I will report back to the group.
Ed Sullivan
Director of Information Services
esullivan@xxxxxxx < mailto:esullivan@xxxxxxx>
KMA Direct Communications
Confidential and Proprietary
-----Original Message-----
From: Jim Harrison [mailto:jim@xxxxxxxxxxxx]
Sent: Tuesday, January 07, 2003 9:46 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Feature Pack 1 RELEASED!
http://www.ISAserver.org
What are the "registry-related problems" you're referring to?
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/pages/author_index.asp?aut=3
http://isatools.org
Read the help / books / articles!
----- Original Message -----
From: Edward <mailto:esullivan@xxxxxxx> Sullivan
To: [ISAserver.org Discussion List] <mailto:isalist@xxxxxxxxxxxxx>
Sent: Tuesday, January 07, 2003 10:33
Subject: [isalist] RE: Feature Pack 1 RELEASED!
http://www.ISAserver.org
Tom, I will let you know if the "Enhanced SMTP filter" listed in the features
overview fixes the registry-related problems with the old SMTP filter. My hope
is that it does!!
Ed Sullivan
Director of Information Services
esullivan@xxxxxxx < mailto:esullivan@xxxxxxx>
KMA Direct Communications
Confidential and Proprietary
-----Original Message-----
From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxxxxxxxxx]
Sent: Tuesday, January 07, 2003 11:19 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] Feature Pack 1 RELEASED!
http://www.ISAserver.org
COME AND GET IT!!!!
http://www.microsoft.com/isaserver/featurepack1/default.asp
Thomas W Shinder
<http://www.isaserver.org/shinder> www.isaserver.org/shinder
<http://tinyurl.com/1jq1> http://tinyurl.com/1jq1
<http://tinyurl.com/1llp> http://tinyurl.com/1llp
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Exchange Server Resource Site: http://www.msexchange.org/
Windows Security Resource Site: http://www.windowsecurity.com/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
esullivan@xxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Exchange Server Resource Site: http://www.msexchange.org/
Windows Security Resource Site: http://www.windowsecurity.com/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
jim@xxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Exchange Server Resource Site: http://www.msexchange.org/
Windows Security Resource Site: http://www.windowsecurity.com/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
esullivan@xxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
Other related posts:
