Release Notes

ManualsBrandsCisco Manualsantivirus security softwareCisco Email Security Appliance C650

Cisco Systems, Inc.

www.cisco.com

Release Notes for AsyncOS 10.0 for Cisco Email

Security Appliances

Published: June 20, 2016

Revised: October 6, 2016

Contents

• What’s New In This Release, page 1

• Changes in Behavior, page 5

• Upgrade Paths, page 6

• Installation and Upgrade Notes, page 7

• Known and Fixed Issues, page 11

• Related Documentation, page 12

• Service and Support, page 13

What’s New In This Release

Feature Description

Office 365 Mailbox Auto

Remediation

A file can turn malicious anytime, even after it has reached user’s mailbox.

AMP can identify this as new information emerges and push retrospective

alerts to your appliance. With this release you get more than just alerting.

If your organization is using Office 365 to manage mailboxes, you can

configure your appliance to perform auto-remedial actions on the

messages in user mailbox when the threat verdict changes.

See the “Automatically Remediating Messages in Office 365 Mailboxes”

chapter in the user guide or online help.

Summary of content (13 pages)

PAGE 1
Release Notes for AsyncOS 10.
PAGE 2
What’s New In This Release Detecting Forged Messages (also known as spoofing, CEO fraud, or business email compromise) Cisco Email Security appliance can detect fraudulent messages with forged sender address (From: header) and perform actions on such messages. Support for On-Premises File Reputation Server If you have deployed a Cisco AMP Virtual Private Cloud appliance on your network, you can now query the file reputation of message attachments without sending them to the public reputation cloud.
PAGE 3
What’s New In This Release Enhanced AMP Reports Advanced Malware Protection page includes the following enhancements: • A new graph that shows the incoming files handled by AMP in percentage based on the verdicts (Clean, Malicious, Unknown, Unscannable). • A new graph that shows the top incoming malware files based on the file types. • A new table that shows the number of incoming files handled by AMP based on the verdicts (Clean, Malicious, Unknown, Unscannable).
PAGE 4
What’s New In This Release Message Tracking Details Users can now view finer details about URLs caught by content and for URLs in Messages outbreak filters. Administrators can configure which users can see this information. See the “Message Tracking” chapter in the user guide or online help.
PAGE 5
Changes in Behavior Changes in Behavior Advanced Malware Protection Behavior Changes • If a message has malformed headers, the appliance will attempt to extract the attachments from the message. If the extracted messages are found to be malicious, the file reputation verdict is set to “malicious.” If the appliance is unable to extract the attachments, the file reputation verdict is set to “unscannable.” • The file reputation verdict for a message without any attachments is set to “skipped.
PAGE 6
Upgrade Paths Mail Policy Matching Logic Changes Prior to this release, while matching a message to a mail policy, the envelope sender (RFC821 MAIL FROM address) and the sender header (address found in the RFC822 From and Reply-To) had the same priority. As a result, if you had configured a mail policy to match a specific user, the messages were classified into that mail policy based on the sender header.
PAGE 7
Installation and Upgrade Notes Caution • 10.0.0-125 • 10.0.0-199 If you plan to upgrade to AsyncOS 10.0.0-203, review the Reverting to Previous AsyncOS Versions, page 8. Installation and Upgrade Notes Read through and consider the installation and upgrade impacts listed in this section. When you upgrade AsyncOS from the web interface or Command Line Interface (CLI), the configuration is saved to file in the /configuration/upgrade directory. You can access the upgrade directory using an FTP client.
PAGE 8
Installation and Upgrade Notes Migrating from a Hardware Appliance to a Virtual Appliance Step 1 Set up your virtual appliance with this AsyncOS release using the documentation described in Deploying or Upgrading a Virtual Appliance, page 7. Step 2 Upgrade your hardware appliance to this AsyncOS release. Step 3 Save the configuration file from your upgraded hardware appliance Step 4 Load the configuration file from the hardware appliance onto the virtual appliance.
PAGE 9
Installation and Upgrade Notes • 9.7-2-054 • 10.0.0-124 • 10.0.0-125 If you upgrade to AsyncOS 10.0.0-203 from one of the above versions, you cannot revert to any of the previous versions. FIPS Compliance AsyncOS 10.0 release is not a FIPS compliant release. If you have enabled FIPS mode on your appliance, you must disable it before upgrading to AsyncOS 10.0.
PAGE 10
Installation and Upgrade Notes Procedure Use the following instructions to upgrade your Email Security appliance. Step 1 Save the XML configuration file off the appliance. Step 2 If you are using the Safelist/Blocklist feature, export the Safelist/Blocklist database off the appliance. Step 3 Suspend all listeners. Step 4 Wait for the queue to empty. Step 5 From the System Administration tab, select the System Upgrade page. Step 6 Click the Available Upgrades button.
PAGE 11
Known and Fixed Issues If you change your anti-spam policy from dropping spam to quarantining it (either on-box or off-box), then your system load will increase due to the need to scan additional spam messages for virus and content security. For assistance in properly sizing your installation please contact your authorized support provider. Known and Fixed Issues Use the Cisco Bug Search Tool to find information about known and fixed defects in this release.
PAGE 12
Related Documentation • Note To view the list of known issues, select Affecting these Releases from the Show Bugs drop down and select Open from the Status drop down. If you have questions or problems, click the Help or Feedback links at the top right side of the tool. There is also an interactive tour; to view it, click the link in the orange bar above the search fields.
PAGE 13
Service and Support Service and Support Note To get support for virtual appliances, have your Virtual License Number (VLN) number ready when you call Cisco TAC. Cisco TAC: http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html Support Site for legacy IronPort: http://www.cisco.com/web/services/acquisitions/ironport.html For non-critical issues, you can also access customer support from the appliance. For instructions, see the User Guide or online help.