Cisco Spam & Virus Blocker review

Cisco initially used its acquisition of IronPort in 2007 to deliver an enterprise-level anti-spam solution. Its latest Spam & Virus Blocker (SVB) takes the same sophisticated technology and delivers it at a price that's affordable for SMEs.

The appliance can handle up to 250 users, and with an initial price of under a grand for a one-year subscription it looks good value. When we reviewed IronPort's C60 we were impressed with its anti-spam and antivirus capabilities, so we were interested to see how well they worked in the SVB.

The SVB delivers the same swift installation process we saw with the C60, and Cisco has added a wizard routine to make it even easier. It provides a dedicated management port, so you just point a web browser at its default address, enter your network settings and set anti-spam and antivirus options.

From the quick start security page you can block spam, quarantine it on the mirrored internal hard disks or tag and deliver it. There's nothing much to do for the Sophos antivirus component as you just ask for infected mail to be blocked.

Appliance updates run every five minutes, and there's an optional wizard for integrating the appliance into your AD domain. The SVB starts with a default public listener that manages all inbound and outbound mail, but adding more allows you to create message policies based on users, groups and domains.

Mail is subjected to an extensive barrage of tests called the Work Queue. It uses a strict processing order with LDAP routing and masquerading functions coming first, followed by message filters and a two-pronged anti-spam defence comprising the IronPort filtering and SenderBase reputation filters. Next up is antivirus scanning, followed by your own custom message content filters that employ Layer 7 inspection.

For testing, we set up the SVB in a live environment, where it filtered incoming messages and passed them to our internal AD server running Kerio's MailServer. We configured the SVB to pass all messages and tag spam, and on a Windows client system we used Outlook's rules to place tagged messages in separate folders.

We left the SVB on its default settings and it recorded a near perfect score, catching and tagging every spam message with no false positives.

The monitor screen opens with an overview of all message activity and provides options to view inbound and outbound messages plus all action for the content filters and virus scanner. Reporting facilities are also good, with options for running scheduled reports on selected activities and time periods and emailing them to multiple recipients.

Along with its ease of deployment, Cisco's Spam & Virus Blocker scores highly for its level of features and policy-based security. It's rare to see anti-spam appliances at this price with such high success rates.

Author: Dave Mitchell