If you have multiple Cisco Ironport C350 devices, you may have noticed that safelist \/ blocklist entries are bound to an individual device. So if your Ironport devices are both installed to handle incoming mails, end users need to manage safelists\/blocklists on both devices in order to be sure that both devices operate in the same way.<\/p>\n
This is a problem, because, to an end user, it should not matter where they manage the safelist\/blocklist, they only want to do it just one time and on one device, and not multiple times. <\/p>\n
In order to capture the safelist\/blocklist database from multiple devices, merge the lists, and then activate the merged lists on all devices, you would need to use the backup & restore features.<\/p>\n
The Cisco Ironport CLI allows admins to create a backup of the configuration, but surprisingly this does not include the safelist\/blocklist database. The management GUI allows administrators to backup & restore safelists\/blacklists, but it cannot be scheduled. Cisco Ironport support has told me that there is no way to do this.<\/p>\n
So I wrote a small utility that will allow you to <\/p>\n
All of these actions are CLI commands, so you can build a batch script file and use Windows Scheduled Tasks to run this at any given time.<\/p>\n
In order for the application to run, the following requirements must be met :<\/p>\n
1. The server\/computer running the script must have access to the Ironport interfaces that are activated for management.<\/p>\n
2. The Ironport must be configured for management over HTTPS and SSH, and must allow FTP access as well. If there is a firewall between the server\/computer running the scripts and the interface that hosts the management ports, the ports for HTTPS, SSH and FTP must be open<\/p>\n
3. The user account used in the script must have admin access<\/p>\n
4. pscp.exe (Putty) needs to be present in the working directory<\/p>\n
<\/p>\n
<\/p>\n
If you run the tool without parameters, you'll get this :<\/p>\n
-------------------------------------------------------\nPVE Cisco Ironport Safelist and Blocklist Merge utility\nhttp:\/\/freetools.corelan.be\npeter.ve@telenet.be\nJuly 2008\nVersion 1.0.0.1\n-------------------------------------------------------\nCurrent date & time : 27\/07\/2008 13:09\n-------------------------------------------------------\n\n===== Unlicensed copy =====\n\n\nUsage :\n-------\nCreate request for license file :\n -lic\n\nGet Safelist & blocklist from device :\n -h <<\/span>Ironport<\/span> host<\/span>><\/span> -p <<\/span>https<\/span> port<\/span>><\/span> -fp <<\/span>ftp<\/span> port<\/span>><\/span> _<\/p>
-u <<\/span>username<\/span>><\/span> -pw <<\/span>password<\/span>><\/span> -m backup _<\/p>
-fe <<\/span>export_list_as_filename<\/span>><\/span>
[-w <max. wait>] (optional parameter, default=30, so max wait time will be 30 x 10 seconds
\nMerge multiple files :\n -fm "file1,file2,file3,file4,..." -m merge _<\/p>-smf <<\/span>save_merged_file_as<\/span>><\/span>\nPut safelist & blocklist back onto device:\n -h <<\/span>Ironport<\/span> host<\/span>><\/span> -p <<\/span>https<\/span> port<\/span>><\/span> -sp <<\/span>ssh<\/span> port<\/span>><\/span> _<\/p>
-u <<\/span>username<\/span>><\/span> -pw <<\/span>password<\/span>><\/span> -m restore -fi <<\/span>slbl_filename_to_import<\/span>><\/span>\n\n\nNotes :\nIn order for the backup to work, the device must be reachable <\/p>
over HTTPS and FTP<\/p>
In order for the restore to work, the device must be reachable <\/p>
over HTTPS and SSH, and pscp.exe <\/p>
(http:\/\/the.earth.li\/~sgtatham\/putty\/latest\/x86\/pscp.exe) must <\/p>
be in the current directory as well<\/p>
Finally, the import file must start with slbl_ and have .csv extension<\/p>
In all cases, the useraccount must be member of the operators or administrators<\/p><\/pre>\n<\/div>\n
<\/p>\n
Before you can use the tool, you'll have to create a license request and send the request to me. The tool is free, but I will process your request faster if you donate something\/anything at all using paypal (send to peter.ve@telenet.be)<\/a>, or if you pick something off my Amazon wish lists (Books<\/a> - Electronics<\/a>). In the email that contains the license request, you should either mention a reference to the paypal or amazon transaction, or you should include "I do not wish to donate at this time". Don't feel obliged to donate. <\/p>\n
You can create a license request by running<\/p>\n
\nPVEIronportSafeBlockListMerger.exe -lic<\/pre>\n<\/div>\nNext, take the .req file, and send it to peter.ve@telenet.be<\/a> (don't forget the small text that either includes the donation information as explained above, or the text "I do not want to donate at this time"). Also, please specify the username\/company name and email address that should be used in the license file). If these entries are not in the email, I won't be able to create a license file.<\/p>\n
When you receive the license file, just put it in the same folder as the .exe file. If the .lic file is present and if you run the tool again, you should see the license information :<\/p>\n
\n-------------------------------------------------------\nPVE Cisco Ironport Safelist and Blocklist Merge utility\nhttp:\/\/freetools.corelan.be\npeter.ve@telenet.be\nJuly 2008\nVersion 1.0.0.0\n-------------------------------------------------------\nCurrent date & time : 27\/07\/2008 13:11\n-------------------------------------------------------\n\n=================================================\nLicensed copy\nLicensed to : Peter Van Eeckhoutte\nEmail address : peter.ve@telenet.be\n=================================================<\/pre>\n<\/div>\n<\/p>\n
A. Get the safelist\/blocklist database and save it locally on your server\/computer into a csv file<\/h4>\n
(run this against all of your Ironports, and save the files into unique, separate files)<\/p>\n
\nPVEIronportSafeBlockListMerger.exe -h ironport1.domain.com _<\/font><\/strong><\/p>
-p 443 -fp 21 -u admin -pw YourAdminPassword -m backup _<\/font><\/strong><\/p>
-fe Ironport1.csv<\/font><\/strong>\n -------------------------------------------------------\n PVE Cisco Ironport Safelist and Blocklist Merge utility\n http:\/\/freetools.corelan.be\n peter.ve@telenet.be\n July 2008\n Version 1.0.0.1\n -------------------------------------------------------\n Current date & time : 27\/07\/2008 13:12\n -------------------------------------------------------\n\n =================================================\n Licensed copy\n Licensed to : Peter Van Eeckhoutte\n Email address : peter.ve@telenet.be\n =================================================\n\n [+] Task Summary\n Mode : backup\n Ironport host : ironport1.domain.com\n HTTPS port : 443\n FTP port : 21\n Username : admin\n Password : <<\/span>hidden<\/span>><\/span>\n Export list to : Ironport1.csv\n Max wait time : 40 times 10 secs\n\n\n [+] Logging in to Ironport ironport1.domain.com:443 as user admin\n [ ] Logged in\n [+] Creating backup of safelist and blocklist and copying backup to this machine as file Ironport1.csv\n [ ] Please wait until device finishes backup - This can take a while...\n (I'll wait 10 seconds to start with)\n [+] Generating blacklist\/safelist file\n [+] Verifying that file doesn't grow anymore\n Current size : 179 bytes\n [+] File size is stable now\n [+] Saving Safelist\/Blocklist file as Ironport1.csv\n [+] Backup complete.\n\n [ ] File downloaded : slbl-<<\/span>XXXXXXXXXXXXXX<\/span>><\/span>-20080727T111250.csv (27\/07\/2008 13:12)\n Number of other (old) slbl*.csv files removed : 0<\/p><\/pre>\n<\/div>\n
\n<\/p>
<\/p>
dir *.csv\n<\/font><\/strong> Volume in drive C has no label.\n Volume Serial Number is 585F-8B81\n\n Directory of C:\\ironport\n\n27\/07\/2008 13:13 179 Ironport1.csv\n 1 File(s) 179 bytes\n 0 Dir(s) 25.898.405.888 bytes free<\/p><\/pre>\n<\/div>\n
<\/p>\n
Once you have downloaded all safelist\/blocklist files to individual files, you can merge the files together and then upload them back to the various devices.<\/p>\n
Of course, you can also use this command to only create a backup of the safelist\/blocklist databases.<\/p>\n
<\/p>\n
B. Merge the safelist\/blocklist<\/h4>\n
Suppose you have 2 Ironport devices, and you have saved the individual files to Ironport1.csv and Ironport2.csv, then this is the command to use :<\/p>\n
\nPVEIronportSafeBlockListMerger.exe -fm "Ironport1.csv,Ironport2.csv" _<\/font><\/strong><\/p>
-m merge -smf "IronportMerged.csv"\n<\/font><\/strong> -------------------------------------------------------\n PVE Cisco Ironport Safelist and Blocklist Merge utility\n http:\/\/freetools.corelan.be\n peter.ve@telenet.be\n July 2008\n Version 1.0.0.1\n -------------------------------------------------------\n Current date & time : 27\/07\/2008 13:40\n -------------------------------------------------------\n\n =================================================\n Licensed copy\n Licensed to : Peter Van Eeckhoutte\n Email address : peter.ve@telenet.be\n =================================================\n\n [+] Task Summary\n Mode : merge\n Merge files : Ironport1.csv,Ironport2.csv\n Save merged output to : IronportMerged.csv\n\n\n [+] Reading input files\n [ ] Opening file Ironport1.csv\n [ ] Opening file Ironport2.csv\n [+] Merging input files to IronportMerged.csv\n [+] Output written to IronportMerged.csv<\/p><\/pre>\n<\/div>\n
<\/p>\n
C. Deploy the merged file back to your Ironports<\/h4>\n
The last step is to copy the file back to the Ironports and to activate\/restore this file. This mode requires pscp.exe to be present in the working directory. If, for any reason, the application appears to hang at "Copying file to....", then download plink.exe from PuTTY Download Page<\/a>, put it in the same folder, and use plink.exe to connect to the Ironports. This will allow you to save the ssh key for each Ironport device. From that point forward, the merge utility should work just fine (and you can even remove plink.exe again if you want to)<\/p>\n
\nPVEIronportSafeBlockListMerger.exe -h ironport1.domain.com _<\/font><\/strong><\/p>
-p 443 -sp 22 -u admin -pw YourAdminPassword -m restore _<\/font><\/strong><\/p>
-fi IronportMerged.csv<\/font><\/strong>\n -------------------------------------------------------\n PVE Cisco Ironport Safelist and Blocklist Merge utility\n http:\/\/freetools.corelan.be\n peter.ve@telenet.be\n July 2008\n Version 1.0.0.1\n -------------------------------------------------------\n Current date & time : 27\/07\/2008 13:43\n -------------------------------------------------------\n\n =================================================\n Licensed copy\n Licensed to : Peter Van Eeckhoutte\n Email address : peter.ve@telenet.be\n =================================================\n\n [+] Task Summary\n Mode : restore\n Ironport host : ironport1.domain.com\n HTTPS port : 443\n SSH port : 22\n Username : admin\n Password : <<\/span>hidden<\/span>><\/span>\n Import from file : IronportMerged.csv\n\n\n [+] Copying file IronportMerged.csv to Ironport ironport1.domain.com using SCP (port 22)\n [+] File copied to Ironport\n [+] Logging in to Ironport ironport1.domain.com:443 as user admin\n [ ] Logged in\n [+] Activating restored safelist\/blacklist file IronportMerged.csv\n [ ] Please wait until device finishes restore - This can take a little while...\n [+] Done.<\/p><\/pre>\n<\/div>\n
<\/p>\n
Run this command against all Ironports, and you should be all set.<\/p>\n
<\/p>\n
Download the utility<\/h3>\n
You can download the utility from http:\/\/users.telenet.be\/internet.activities\/freetools<\/a><\/p>\n
After downloading the zip file, extract it to a folder (e.g. c:\\ironport) and run the utility from the command line<\/p>\n
(or from a batch script)<\/p>\n
<\/p>\n
<\/p>\n
Version history<\/h3>\n