If your network is configured as described in Network Planning, incoming mail from the Internet is received by appliances in the outer DMZ. Clean mail is sent along to the mail transfer agent (MTA) (groupware) in the inner DMZ and eventually to the end users within the corporate network.

Spam and suspected spam (depending on your mail flow policy settings) is sent to the spam quarantine on Cisco Secure Email and Web Manager. End users may then access the quarantine and elect to delete spam and release messages that they would like to have delivered to themselves. Messages remaining in the spam quarantine are automatically deleted after a configurable amount of time.

Messages that are released from the external quarantine on the Cisco Secure Email and Web Manager are returned to the originating email gateway for delivery. These messages do not normally pass through the following processes before delivery: HAT and other policy or scanning settings, RAT, domain exceptions, aliasing, incoming filters, masquerading, bounce verification, and the work queue.

An email gateway that is configured to send mail to a Cisco Secure Email and Web Manager will automatically expect to receive mail released from the Cisco Secure Email and Web Manager and will not reprocess those messages when they are received back. For this to work, the IP address of the Cisco Secure Email and Web Manager must not change. If the IP address of the Cisco Secure Email and Web Managerchanges, the receiving email gateway will process the message as it would any other incoming message. You should always use the same IP address for receiving and delivery on the Cisco Secure Email and Web Manager.

The Cisco Secure Email and Web Manager accepts mail for quarantining from the IP addresses specified in the spam quarantine settings. To configure the spam quarantine on the Security Management appliance, see the Cisco Secure Email and Web Manager User Guide.

Mail released by the Cisco Secure Email and Web Manager is delivered to the primary and secondary hosts (content security appliance or other groupware host) as defined in the spam quarantine settings (see the Cisco Secure Email and Web Manager User Guide). Therefore, regardless of the number of email gateways delivering mail to the Cisco Secure Email and Web Manager, all released mail, notifications, and alerts are sent to a single host (groupware or content security appliance). Take care not to overburden the primary host for delivery from the Cisco Secure Email and Web Manager.

If you are currently using the local spam quarantine on an email gateway but would like to migrate to an external spam quarantine hosted on a Cisco Secure Email and Web Manager — while retaining access to the messages in the local quarantine — you should prevent new messages from entering the local quarantine during the transition.

Consider the following possible strategies:

• Configuring anti-spam settings — Configure the anti-spam settings on your mail policy specifying Cisco Secure Email and Web Manager as the alternate host. This action sends new spam to the external quarantine while still allowing access to the local quarantine.
• Setting a shorter expiration time — Configure the Schedule Delete After setting on the local quarantine to a shorter duration.
• Deleting all of the remaining messages — To delete all remaining messages in the local quarantine, disable the quarantine and the click the “Delete All” link on the local quarantines page (see Deleting Messages from the Spam Quarantine). This link only becomes available when a local spam quarantine with messages still contained in it has been disabled.

You should now be ready to enable the external quarantine and disable the local quarantine.

Note	If both the local quarantine and the external quarantine are enabled, the local quarantine is used.

Problem: Messages released from Cisco Secure Email and Web Manager are unnecessarily reprocessed by the email gateway.

Solution: This can occur if the IP address of Cisco Secure Email and Web Manager has changed. See Mail Flow and External Spam Quarantine.

You can centralize policy, virus, and outbreak quarantines on a Cisco Secure Email and Web Manager. Messages are processed by email gateways but are stored in quarantines on Cisco Secure Email and Web Manager.

Centralizing policy, virus, and outbreak quarantines offers the following benefits:

• Administrators can manage quarantined messages from multiple email gateways in one location.
• Quarantined messages are stored behind the firewall instead of in the DMZ, reducing security risk.
• Centralized quarantines can be backed up using the standard backup functionality on Cisco Secure Email and Web Manager.

For complete information, see the user guide or online help for your Cisco Secure Email and Web Manager.

When you centralize policy, virus, and outbreak quarantines, existing policy, virus, and outbreak quarantines on your email gateway migrate to Cisco Secure Email and Web Manager.

You will configure migration on Cisco Secure Email and Web Manager, but migration occurs when you commit the change enabling centralized policy, virus, and outbreak quarantines on the email gateway.

As soon as you commit this change, the following occur:

• Local policy, virus, and outbreak quarantines on the email gateway are disabled. All new messages entering these quarantines will be quarantined on Cisco Secure Email and Web Manager.
• Migration of existing non-spam quarantines to Cisco Secure Email and Web Manager begins.
• All local policy, virus, and outbreak quarantines are deleted. If you configured a custom migration, any local policy quarantines that you chose not to migrate are also deleted. For effects of deleting policy quarantines, see About Deleting Policy Quarantines.
• A message that was in multiple quarantines before migration will be in the corresponding centralized quarantines after migration.
• Migration happens in the background. The amount of time it takes depends on the size of your quarantines and on your network. When you enable centralized quarantines on the email gateway, you can enter one or more email addresses that will receive notification when migration is complete.
• The settings in the centralized quarantine, not those of the originating local quarantine, apply to the messages. However, the original expiration time still applies to each message.

Note	All centralized quarantines that are automatically created during migration have the default quarantine settings.

When you disable centralized policy, virus, and outbreak quarantines on the email gateway:

• Local quarantines are automatically enabled on the email gateway.
• System-created quarantines and quarantines that are referenced by message filters, content filters, and DLP message actions are automatically created on the email gateway. The Virus, Outbreak, and Unclassified quarantines are created with the same settings that they had before quarantines were centralized, including assigned user roles. All other quarantines are created with default settings.
• Newly quarantined messages go immediately to local quarantines.
• Messages in the centralized quarantine at the time it is disabled remain there until one of the following occurs:
  • Messages are manually deleted or automatically deleted when they expire.
  • Messages are manually or automatically released, if one of the following is also true:

* An alternate release appliance is configured on Cisco Secure Email and Web Manager. See the online help or documentation for Cisco Secure Email and Web Manager.

* Centralized quarantines are again enabled on the email gateway.

If a Cisco Secure Email and Web Manager Goes Out of Service

If Policy, Virus, and Outbreak Quarantines are centralized on a Cisco Secure Email and Web Manager that goes out of service, you should disable these centralized quarantines on the email gateway.

If you deploy a replacement Cisco Secure Email and Web Manager, you must reconfigure quarantine migration on Cisco Secure Email and Web Manager and on each email gateway. See the table in the “Centralizing Policy Virus, and Outbreak Quarantines” section in the “Centralized Policy, Virus, and Outbreak Quarantines” chapter in the online help or user guide for Cisco Secure Email and Web Manager.