Skip to main content

Whitelisting Arsen in Cisco Secure Email (CES)

Allow-listing Arsen prevents Cisco Secure Email (CES) from blocking, rewriting or clicking the links in Arsen simulations, which skews campaign results.

1 - Objectives

  • Recognize when Cisco CES interferes with campaign tracking

  • Exempt Arsen in the relevant Cisco areas

  • Test the configuration

2 - Prerequisites

  • Administrator access to the Cisco CES web interface.

  • The list of active Arsen phishing domains.

  • Arsen sending IP addresses: 161.38.204.14 and 185.211.123.249.

  • The menus below follow the Cisco AsyncOS documentation and may vary by version. If a setting is missing, contact Cisco support or your email security administrator.

3 - Typical symptom

The campaign email is delivered, but the recipient shows as clicked almost immediately, before any realistic interaction. This usually means Cisco CES scanned or rewrote the link before delivery.
​

With API delivery (Microsoft Email Delivery), emails do not come from Arsen IP addresses: only the domain-based exemptions (sections 6 and 7) need to be checked.
​

4 - Export the full list of Arsen domains

  1. Open Arsen phishing domains.

  2. Click export.

  3. Add every active domain to the Cisco exemptions in sections 6 and 7.

5 - Cisco areas to check

A single exemption is often not enough. Check each area.

Area

Cisco menu

What to enter

Allowed senders (HAT)

Mail Policies > HAT Overview > ALLOWED_LIST

Arsen IPs

Outbreak Filters

Mail Policies > Incoming Mail Policies > Outbreak Filters > Bypass Domain Scanning

Arsen domains

URL Filtering

Mail Policies > URL Lists, then Security Services > URL Filtering > Edit Global Settings

Arsen domains

Content and message filters

Mail Policies > Incoming Content Filters (message filters via CLI)

Allowed URL list

6 - Exempt Arsen from Outbreak Filters

Outbreak Filters rewrites URLs and analyzes them in the Talos cloud. Domains entered in Bypass Domain Scanning are excluded from this rewriting.

  1. Open Mail Policies > Incoming Mail Policies > Outbreak Filters.

  2. Edit the relevant policy (at least Default).

  3. In Message Modification, add the Arsen domains to Bypass Domain Scanning, separated by commas.

  4. Click Submit, then Commit Changes.

7 - Add Arsen to the allowed URL list (URL Filtering)

URLs on the global allowed list are not evaluated by URL Filtering, anti-spam, Outbreak Filters, or content and message filters. This list is independent of Bypass Domain Scanning: fill in both.

  1. Open Mail Policies > URL Lists and create a list, for example arsen_phishing_urls.

  2. Add the Arsen domains to it.

  3. Open Security Services > URL Filtering > Edit Global Settings and select this list.

  4. Click Submit, then Commit Changes.

8 - Check content and message filters

A custom filter can rewrite or quarantine links despite the exemptions above.

  1. Open Mail Policies > Incoming Content Filters.

  2. In every filter that uses an URL Reputation or URL Category condition or action, enter the allowed URL list from section 7.

  3. Have an administrator review the message filters, which can only be managed from the command line (filters).

  4. Click Commit Changes.

9 - Allow Arsen by IP address (HAT)

If you use Email Delivery through our API integration, this step does not apply to you.

Members of the ALLOWED_LIST group are not subject to anti-spam scanning or rate limiting. Antivirus remains active.

  1. Open Mail Policies > HAT Overview and select the inbound listener.

  2. Click ALLOWED_LIST, then Add Sender.

  3. Enter 161.38.204.14 and 185.211.123.249.

  4. Click Submit, then Commit Changes.

10 - Test your configuration

  1. Create a campaign for 1 or 2 internal test users.

  2. Send the campaign.

  3. In Monitor > Message Tracking, check that the link is not rewritten (rewritten URL in the logs).

  4. In Arsen, check that no click is recorded before the user acts.

11 - If automatic clicks persist

  1. Check that the exact phishing domain used in the campaign is listed in sections 6 and 7.

  2. Check whether the link was rewritten before delivery.

  3. Check the other security layers, for example Microsoft Safe Links and the Advanced Delivery Policy.

  4. If you also use Cisco Secure Email Cloud Mailbox Defense (post-delivery analysis), ask Cisco to check it: the Cisco community has reported an issue with phishing simulations.

  5. Note the source IP and user agent of the clicks in Arsen: a Cisco or Microsoft IP identifies the tool responsible.

12 - What to share with Arsen support if the problem continues

  • The Cisco product and its version (for example CES 16.5.0-780).

  • The name of the affected campaign and test recipient.

  • The exact phishing domain used in the campaign.

  • Screenshots of the Cisco exemptions already configured.

  • Cisco logs or Message Tracking details.

  • Confirmation of whether the link was rewritten before delivery.

Cisco documentation

Related Articles
Did this answer your question?