If an email is coming from an external user destined for someone in the corporate LAN, the firewall sends all inbound email traffic to the Cisco ESA. The Cisco ESA will process the inbound email messages through each of the filters described in the Incoming mail processing section. If the email message is clean, the ESA forwards it to the destined user in the corporate LAN. If one of the filters detects a threat, the ESA drops the email message:

If a user of the corporate LAN is sending an email, the Cisco ESA inspects it before sending it to the firewall to route it to its intended recipient. If a threat is detected by one of the filters in the Outgoing mail processing section, the email is contained and is not forwarded. The Cisco ESA also provides protection to external networks, thus preventing an outbreak from spreading.