Cisco IronPort ESA CLI Reference Card

1 Cisco IronPort ESA CLI Reference card release 20160226, by Jens RoesenDefault user & password, batch command mode and contactsThe default username is admin and it's password is IronPort . The default IP is on Data1 on C1X0 appliances and Management Interface on all access through serial console use 9600/8-N-1 with hardware flow control. Send undetected spam to false positives to missed ads to and false positive ads to Send each as RFC822 MIME encoded attachment. See Knowledge Base article commandshelp command or h commandView online help for a list of currently logged in name and groups for current current date and password for the current list of recently logged in users and session or clearchangesAbandon all pending configuration pending configuration between machine, cluster and group down and power-off the the or quit or qExit CLI.

2 Will warn you about uncommitted and statuscreditsShow the credits for this AsyncOS version. versionShow brief hardware and software extended hardware and software detailView detailed system collected data to determine the health of the details about the last commit in the active pending config changes as nested tree status and latest update for enabled anti-spam status and latest update for active antivirus Web Security Service/URL Filtering statistics and content scanner engine version and latest version and latest updates for SBRS status and last update of Virus Outbreak SenderBase PXE engine status and last engine status of RSA DLP enrollment client version virtual appliance license Graymail version statusDisplay current work queue rate nDisplay number of pending.

3 Incoming and outgoing mails in the queue and refresh every n top hosts by number of incoming status domDisplay destination-queue statistics for the domain nDisplay in/out connections and recipient statistics every n domain nSimilar to rate but limited to a single destination domainView domain statistics including MX settings and latest 5xx the top 20 destination domains in the mail queue. featurekeyView, activate and check for new feature DNS statistics since counter reset / last reboot / nDisplay the last n alerts sent by the version and last update of the support request network and configurationping or ping6 Test network by sending a IPv4/IPv6 ping to a remote ortraceroute6 View IPv4/IPv6 network path/routing to a remote to a remote host. Defaults to port 25, not 23!

4 DigRun DNS queries. Supports batch DNS a packet capture in AsyncOS versions up from a packet capture in AsyncOS versions up to information about running TCP/IP current network connections, network statistics, interface status, listen queue size or routing the mail flow through the system with a virtual test an LDAP query against a configured LDAP all cached LDAP query test an IP against a DNS-based DNS and verify a TLS connection to a remote configurationsystemsetupRun the system setup wizard. This will remove any existing listener and associated HAT a virtual appliance XML license into CLI or load one from and manage users and external banner, restrict access on IP basis, configure XSS and CSRF protection and CLI/Web UI , delete and edit IP interface settings (IPv4 and IPv6).

5 EtherconfigConfigure ethernet settings (speed/duplex mode, VLANs , NIC pairing)diskquotaconfigConfigure disk space quotas for several and edit system health checks system default static network DNS servers and domain DNS settings. dnshostprefsConfigure global or per domain DNS resolver global settings for DNS blacklist auto-download and activation of feature , delete and manage LDAP server SNMP, set community string and password, define trap NTP Servers and source interface for NTP sshd settings and view, add, delete or modify SSH user SSL for SMTP and HTTPS GUI access (SSL Versions, Ciphers).sslv3configEnable/disable SSLv3 for EUQ, LDAP, Updater or time time zone system time and date as MM/DD/YYYY HH:MM:SSsetttymodeSet the TTY mode to interactive or browser settings (IE compatibility override mode).

6 ReportingconfigConfigure reporting mail alert settings and mail alert message tracking From: address to be used for mails generated by the FIPS mode to meet FIPS 140-2 all counters of a single machine. IronPort , AsyncOS , IOS and SenderBase are all registered trademarks of Cisco Systems, Inc. - Licensed under CC BY NC SA . Latest version of the card is available at USE COMMANDS AT YOUR OWN RISK. NO WARRANTIES SMTP smtproutesAdd, delete, edit and view SMTP routing. listenerconfigConfigure and manage public, private or blackhole mail delivery destination control limits for a specified and manage the domain exception , create and modify virtual gateway mappings for sender addresses or client and modify bounce and manage incoming and outgoing mail text blocks for use in disclaimers, anti-virus alerts, DLP, encryption notifications or , edit and view message Sieve filtering char used in LDAP Accept and Routing.

7 DictionaryconfigCreate and manage content SSL for TLS connections (Versions, Ciphers).certconfigManage certificates in PEM format and CRLs and , edit, view and test SMTP Call-Ahead and manage SMTP authentication and manage address and manage the alias bounce verification address , manage and test tons of DKIM and manage system and outbreak and manage or export End-User incoming mail relay DMARC verification profiles and modify global S/MIME settings and manage locale modification and enforcement configuration filesshowconfigView XML configuration file as paged XML configuration file via XML configuration file in the /configuration XML configuration file from the /configuration directory or paste it directly into the back to one of the last 10 saved ALL configurations to factory message queues and mailsshowrecipientsShow messages from the queue by recipient host name, sender address or all mails in the messages from the queue by recipient host name, sender address or all mails in the messages from the queue by recipient host name.

8 Sender address or all mails in the all mails to a relay a complete message by MID in a message by it's MID as mbox file to the /configuration a message from work, retry or destination Headers and MID of the oldest message in the to deliver pending messages either by domain or simply reschedule all unsubscribe lists for recipient addresses that will always be bounced or all headers by name in this table from all queue. DELETES ALL QUEUED IronPort Support and advanced diagnosticssupportrequestOpen a support request with Cisco immediate update of support request a tunnel for Cisco Support to access the Check RAID status, flush DNS/ARP/LDAP caches, test remote SMTP servers, check disk quota and usage or reset countermeasures and resource conservation alert-on-core core files from disk and view status from last wipe login with user enablediag if normal login fails.

9 Same password as "admin".Working with logsgrepSearch for a Regular Expression pattern inside a log an event in the logs matching either a message id, a mail address (From: / To:) or a subject. Menu driven or batch display new entries from the end of a log a rollover on one specific log or simply all log and manage log files and delivery methods (FTP, SCP, Syslog). View public RSA/DSS key from security servicesupdateconfigConfigure update URLs and HTTP/HTTPS proxies to will also affect AsyncOS forceManually update all components. Force updating with the option force. The force option also works with all other update IronPort anti-spam and Intelligent request immediate anti-spam rules and view anti-virus settings and request immediate anti-virus definitions immediate content scanner engine scanner options like skipped file types, scanning depth (nesting), maximum scan size, scanner CASE and SPF verdict , disable and configure Outbreak Filters.

10 OutbreakupdateRequest immediate update of CASE rules and the current in-memory and disk-cached Outbreak IronPort PXE mail request immediate PXE engine request immediate RSA DLP engine RSA DLP engine and config to the previous RSA Enterprise Manager Enterprise Manager integration enrollment client used to obtain certificates for URL immediate update of the enrollment Graymail Detection and Safe Unsubscribe manual update of graymail request immediate SBRS engine SenderBase SBNP statistics sharing advanced malware scanning and clear file reputation basic settings for URL filtering. For more advanced configuration use the URL filtering URL whitelists for skipping category and reputation checks. imageanalysisconfigConfigure the IronPort Image Analysis settings and the address of the Cisco Aggregator or export End-User SenderBase statistics-sharing with unhashed managementupdateconfigConfigure update URLs and HTTP/HTTPS proxies to use.