Congestion control is controlling the amount of traffic entering into a network to avoid congestive collapse. Congestion control should not be confused with flow control, which prevents the sender from overwhelming the receiver.
Options for controlling congestion on the MTA interface
The Email Security - Server appliance uses two optional methods to control congestion on the Mail Transfer Agent (MTA) interface: analysis bypass and connection refusal.
Both methods are available in all analysis modes:
block analysis and monitor analysis (used in MTA deployments)
drop analysis (used in BCC deployments)
Tap/Span analysis (used in SPAN/TAP deployments)
For details about appliance deployments, see the Email Security - Server System Administration Guide.
Note
One or both of the analysis congestion methods can be enabled at the same time. Both options are enabled by default.
Analysis bypass
When the combined number of email attachments and URLs waiting to be analyzed exceeds a specific threshold, new incoming emails are accepted and delivered without being analyzed. However, the Email Security - Server appliance will still analyze all the URLs within the email body, regardless of the queue status, and take actions based on the verdicts.
By default, the Analysis Bypass option is enabled and is configured with the threshold level of 2000 queued emails and URLs.
Connection refusal
Congestion control works on the default pether3 interface or the pether4 interface. When the number of incoming emails waiting to be analyzed exceeds a specific threshold, the appliance disables the pether3 or pether4 interface so that subsequent incoming emails are refused. Emails already in the queue are delivered to the next-hop device. When the number of queued emails falls below the Connection Refusal threshold, the appliance automatically re-enables the pether3 or pether4 interface and the SMTP interface.
By default, the Connection Refusal method is enabled and the Connection Refusal threshold is set to 10,000 queued emails.
Note
You can manually disable the SMTP interface during maintenance activities. For example, you could stop the SMTP interface and wait for queued emails to be processed before beginning an appliance upgrade. For details, see the "Maintenance Support" chapter in the Email Security - Server System Administration Guide.
Congestion control messages
Information-level syslog messages show the attachments queue level and the email queue hold counts, active counts, and incoming counts. Warning-level syslog messages are generated when the SMTP interface is disabled or enabled. SNMP traps are generated when the SMTP interface is disabled or enabled, and when the bypass state is entered and then exited.
When the number of queued emails reaches 30% of the congestion high threshold, a warning notification is displayed. When the number of queued emails reaches 70% of the congestion high threshold, a critical notification is displayed.
You can enable congestion control either through the Email Security - Server Web UI or the Email Security - Server CLI.
Caution
Threshold values typically do not need to change. This should be done with extreme care or with the guidance ofTrellix Technical Support.