Using ASSP with Zimbra
ASSP is most easily implemented with Zimbra as a separate appliance. A simple and modest box running your favorite flavor of Linux will do the trick, or possibly even a virtual machine. Simply configure ASSP to point at your Zimbra host. This gives you not 1 but 2 anti-spam systems. If you prefer to keep it simple you could easily disable the provided system with Zimbra using the Admin console.
A second implementation would be only slightly more complex. It would involve changing the receiving SMTP port in Zimbra to a custom one of your choosing. Install ASSP and configure it to listen on the default port of 25 and specifying in the ASSP configuration to forward to localhost at the custom Zimbra specified port number. In this way both services could co-exist. This configuration is probably more susceptible to issues during upgrades, but reduces the amount of hardware or virtual instances to be maintained.
No matter which method you choose for handling incoming e-mail, you must also configure all outgoing e-mail to be forwarded to the ASSP instance as well if you want ASSP to maintain its automatic whitelist. To do this, specify the address (and port) of the ASSP instance in the "Smart Host" field in the Zimbra administration console.
You will also need to ensure that ASSP administrators and users can send e-mail *to* ASSP. The slickest way to do this, I think, is to create distribution lists in Zimbra with a single address equal to the desired ASSP reporting address. For example, create a distribution list named ASSP.Spam@yourdomain.com and enter a single list member - email@example.com. Make the display name something like "ASSP: Forward Spam Here." The whole point of this exercise is to get the ASSP reporting addresses into Zimbra's GAL. Use a naming convention for these addresses so they all sort together in the GAL. In this example, each display name would begin with "ASSP: ". One should also put the prefix - in this case "ASSP" - in the "First Name" blank and the function - "Forward Spam" - in the "Last Name" when creating the distribution list. Then users can easily look up all the appropriate addresses in the GAL if they forget what they are.