Disable CASE

[Per Tenggren]

Hi,

I've an outbound policy where anti-spam is disabled but still CASE scans the messages before delivery, have anyone else seen this behavior or might it be a bug?

Two files are attached to show the policy and the message tracking.

Br,
Per Tenggren

[Robert Sherwin]

This should not be the case.  Is your appliance in cluster?  If so - do you have settings for both Machine level and Cluster level?  Is it possible that you have Cluster level set for Disable, but yet appliance has Machine level and same policy set for Enabled?

What version AsyncOS is running on your appliance?

My repro w/ outbound & CASE disabled - standalone appliance:

Thu Sep  3 15:13:24 2015 Info: ICID 3701 RELAY SG RELAY_SG match 192.168.0.0/24 SBRS rfc1918
Thu Sep  3 15:13:24 2015 Info: Start MID 4330 ICID 3701
Thu Sep  3 15:13:24 2015 Info: MID 4330 ICID 3701 From: <robert@example.com>
Thu Sep  3 15:13:24 2015 Info: MID 4330 ICID 3701 RID 0 To: <robsherw@cisco.com>
Thu Sep  3 15:13:24 2015 Info: MID 4330 using engine: SPF Verdict Cache using cached verdict
Thu Sep  3 15:13:24 2015 Info: SPF Verdict Cache cache status: hits = 30, misses = 16, expires = 6, adds = 16, seconds saved = 0.16, total seconds = 0.50
Thu Sep  3 15:13:24 2015 Info: MID 4330 SPF: helo identity postmaster@bea1 None 
Thu Sep  3 15:13:24 2015 Info: MID 4330 using engine: SPF Verdict Cache using cached verdict
Thu Sep  3 15:13:24 2015 Info: MID 4330 SPF: mailfrom identity robert@example.com Pass (v=spf1) 
Thu Sep  3 15:13:24 2015 Info: MID 4330 using engine: SPF Verdict Cache using cached verdict
Thu Sep  3 15:13:24 2015 Info: MID 4330 SPF: pra identity robert@example.com None headers from
Thu Sep  3 15:13:24 2015 Info: MID 4330 Message-ID '<24DEB7B8-CCEE-4F74-B7F0-303605FCFDA4@example.com>'
Thu Sep  3 15:13:24 2015 Info: MID 4330 Subject 'HELLO'
Thu Sep  3 15:13:24 2015 Info: MID 4330 ready 657 bytes from <robert@example.com>
Thu Sep  3 15:13:24 2015 Info: MID 4330 matched all recipients for per-recipient policy DEFAULT in the outbound table
Thu Sep  3 15:13:24 2015 Info: ICID 3701 close
Thu Sep  3 15:13:24 2015 Info: MID 4330 queued for delivery
Thu Sep  3 15:13:24 2015 Info: New SMTP DCID 622 interface 192.168.0.189 address 111.22.33.68 port 587
Thu Sep  3 15:13:24 2015 Info: DCID 622 IP: 111.22.33.68 SMTP authentication using the profile nc_rr_com_smtp succeeded.
Thu Sep  3 15:13:24 2015 Info: Delivery start DCID 622 MID 4330 to RID [0]
Thu Sep  3 15:13:26 2015 Info: Message done DCID 622 MID 4330 to RID [0] 
Thu Sep  3 15:13:26 2015 Info: MID 4330 RID [0] Response '2.0.0 OK B5/30-22014-5DB98E55'
Thu Sep  3 15:13:26 2015 Info: Message finished MID 4330 done
Thu Sep  3 15:13:30 2015 Info: SenderBase upload: 1 hosts totaling 3311 bytes
Thu Sep  3 15:13:31 2015 Info: DCID 622 close

[Per Tenggren]

Hi Robert,

Thanks for your reply, the box is a C160 running 8.5.7-042 (non-cluster). It seems to be a delay issue, as 10 minutes later I ran a second test and the policy worked as expected.

Br,
Per Tenggren

[Robert Sherwin · Accepted solution]

No problem.  Happy to help.  If that answers, and there is nothing further - please be sure to mark the thread as answered, or let us know if there is a continued issue/question.

-Robert