Failed to add disclaimer as header

[Givara B]

Hello, 

After I upgrade an ESA "Cisco C690" device from version 12.5.3-035 to 13.5.4-020 emails are not flowing through now. 

When I analysis mail logs, I got this message "Failed to add disclaimer as header. Disclaimer has been added as attachment." and "Deliveries are currently suspended". So can anyone provide solution or tips for this issue? 

Thu Oct 13 16:20:20 2022 Info: MID 263 ready 18772 bytes from <xxxxxxx@gmail.com>
Thu Oct 13 16:20:20 2022 Info: MID 263 matched all recipients for per-recipient policy DEFAULT in the inbound table
Thu Oct 13 16:20:20 2022 Info: New SMTP ICID 66073668 interface Internal (10.x.x.x) address 10.x.x.x reverse dns host unknown verified no
Thu Oct 13 16:20:20 2022 Info: ICID 66073668 REJECT SG None match ALL SBRS not enabled country not enabled
Thu Oct 13 16:20:20 2022 Info: ICID 66073668 close
Thu Oct 13 16:20:21 2022 Info: MID 263 interim verdict using engine: CASE spam negative
Thu Oct 13 16:20:21 2022 Info: MID 263 using engine: CASE spam negative
Thu Oct 13 16:20:21 2022 Info: MID 263 Outbreak Filters: verdict negative
Thu Oct 13 16:20:21 2022 Warning: MID 263 Failed to add disclaimer as header. Disclaimer has been added as attachment.
Thu Oct 13 16:20:21 2022 Info: MID 263 rewritten to MID 264 by add-heading filter 'Heading Stamping'
Thu Oct 13 16:20:21 2022 Info: Message finished MID 263 done
Thu Oct 13 16:20:21 2022 Info: MID 264 queued for delivery
Thu Oct 13 16:20:21 2022 Info: Deliveries are currently suspended [domain_name]

Thank in advice

Givara 

[UdupiKrishna]

An upgrade causing this may be co-incidental, but this generally appears when the encoding of the message body and encoding used in disclaimer are different.

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118501-qa-esa-00.html - follow the procedure highlighted here, set "Y" to option 3 and 4 verify the outcome.

When enabled on a best effort basis ESA will try to add disclaimer in the same encoding as the message body or try to change the message body's encoding to match disclaimer to avoid such errors

[Givara B]

Hi 
Well I've already tried this tip with localeconfig but unfortunately did not help 
Behavior when modifying headers: Use encoding of message body
Behavior for untagged non-ASCII headers: Impose encoding of message body
Behavior for mismatched footer or heading encoding: Try both body and footer or heading encodings
Behavior when decoding errors found: Symbols with decoding errors are skipped in the message body.

But there is another log message which point to internal interface

Info: New SMTP ICID 66202367 interface Internal (10.4.x.x) address 10.4.x.x reverse dns host unknown verified no
Info: ICID 66202367 REJECT SG None match ALL SBRS not enabled country not enabled
Info: ICID 66202367 close

[Givara B]

Hi 
Well I've already tried this tip with localeconfig but unfortunately did not help 
Behavior when modifying headers: Use encoding of message body
Behavior for untagged non-ASCII headers: Impose encoding of message body
Behavior for mismatched footer or heading encoding: Try both body and footer or heading encodings
Behavior when decoding errors found: Symbols with decoding errors are skipped in the message body.

But there is another log message which point to internal interface

Info: New SMTP ICID 66202367 interface Internal (10.4.x.x) address 10.4.x.x reverse dns host unknown verified no
Info: ICID 66202367 REJECT SG None match ALL SBRS not enabled country not enabled
Info: ICID 66202367 close

[UdupiKrishna]

The attempt to fix the behaviour using localeconfig is always on a best effort basis. You can work with TAC to find any other alternatives, like modifying the disclaimer as an attempt to see the outcome.

The log indicates that the connection from 10.4.X.X which landed on internal interface was rejected since it matched "ALL" sender group