I tested the Cisco IronPort C100 (v5.5.1) without the optional Symantec “Brightmail” engine, and it excelled nevertheless. Although the filtering rate was second lowest in the group at 93 percent, which is still quite acceptable, the false positive performance was best in the test. The C100 registered only two bulk false positives and no critical false positives, a feat much more impressive than a high filtering rate.

The Cisco IronPort C100 is typical of Cisco products, with extensive command-line functionality and a more spartan GUI — ironic, considering Cisco acquired IronPort fairly recently and presumably hasn’t had time to influence the development of the product. The IronPort offers all the configuration options you would expect from an enterprise-class system. Still, initial setup and the rest of the configuration process were easy and straightforward, and I only ran into a couple of settings that I had to go to the command line to set.

[ Compare spam filtering statistics for the mail security appliances tested. Compare their features. Return to “Test Center guide: Mail security appliances.” See reviews of the appliances from Barracuda, BorderWare, Cisco, Mirapoint, Proofpoint, Secure Computing, Sendio, Symantec, and Tumbleweed. ]

The C100 offers the full set of capabilities, including incoming and outgoing content inspection, scanning within zip archives, clustering, central administration of multiple devices, a clean interface, and good reporting. It also provides excellent features for handling multiple domains.

Pricing for the system is relatively high but offset by considerable discounts available for multiple-year commitments. This system offers a simple, drop-in installation and good filtering capabilities, especially in terms of low numbers of false positives, which means a minimal impact on users.