提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令支持批处理格式。有关详细信息，请键入命令 help ampconfig 以查阅联机帮助。

• 启用文件信誉和文件分析

• 选择文件类型进行文件分析

• 配置邮件安全设备以使用公共云文件分析服务器

• （仅公共云文件分析服务）配置设备组

• 配置邮件安全设备以使用内部部署文件分析服务器

• 配置邮件安全设备以使用内部部署文件信誉服务器

• 清除本地文件信誉缓存

• 为文件信誉处置值配置缓存有效期

• 禁止文件追溯性判定警报

mail.example.com> ampconfig

File Reputation: Disabled

Choose the operation you want to perform:

- SETUP - Configure Advanced-Malware protection service.

[]> setup

File Reputation: Disabled

Would you like to use File Reputation? [Y]>

Would you like to use File Analysis? [Y]> 

File types supported for File Analysis:

1. Microsoft Executables

Do you want to modify the file types selected for File Analysis? [N]>

Specify AMP processing timeout (in seconds)

[120]>

Advanced-Malware protection is now enabled on the system.

Please note: you must issue the 'policyconfig' command (CLI) or Mail

Policies (GUI) to configure advanced malware scanning behavior for

default and custom Incoming Mail Policies.

This is recommended for your DEFAULT policy.

File Reputation: Enabled

File Analysis: Enabled

File types selected for File Analysis:

1. Microsoft Executables

Choose the operation you want to perform:

- SETUP - Configure Advanced-Malware protection service.

- ADVANCED - Set values for AMP parameters (Advanced configuration).

- CLEARCACHE - Clears the local File Reputation cache.

[]>

mail.example.com> ampconfig
File Reputation: Enabled
File Analysis: Enabled
File types selected for File Analysis:
    Microsoft Windows / DOS Executable
Appliance Group ID/Name: Not part of any group yet
Choose the operation you want to perform:
- SETUP - Configure Advanced-Malware protection service.
- ADVANCED - Set values for AMP parameters (Advanced configuration).
- SETGROUP - Add this appliance to the group of appliances that can share File Analysis reporting details.
- CLEARCACHE - Clears the local File Reputation cache.
[]> advanced
Enter cloud query timeout?
[15]>
Choose a file reputation server:
1. AMERICAS (cloud-sa.amp.sourcefire.com)
2. Private reputation cloud
[1]>
Enter cloud domain?
[cloud-domain.com]>
Do you want use the recommended analysis threshold from cloud service? [Y]>
Enter analysis threshold?
[50]>
Enter heartbeat interval?
[15]> 
Do you want to enable SSL communication (port 443) for file reputation? [N]> 
Do you want to suppress the verdict update alerts for all messages that are 
not delivered to the recipient? [N]>
Choose a file analysis server:
1. AMERICAS (https://americas-fa.com)
2. Private Cloud
[1]>
...

对于发自组织内任意设备的待分析文件，为了允许组织内的所有内容安全设备可以在云中查看这些文件的文件分析结果详细信息，您需要将所有设备加入到同一设备组。

有关详细信息，请参阅《用户指南》中的“文件信誉过滤和文件分析”一章。

mail.example.com> ampconfig
File Reputation: Enabled
File Analysis: Enabled
File types selected for File Analysis:
    Microsoft Windows / DOS Executable
Appliance Group ID/Name: Not part of any group yet
Choose the operation you want to perform:
- SETUP - Configure Advanced-Malware protection service.
- ADVANCED - Set values for AMP parameters (Advanced configuration).
- SETGROUP - Add this appliance to the group of appliances that can share File Analysis reporting details.
- CLEARCACHE - Clears the local File Reputation cache.
[]> setgroup
Does your organization have multiple Cisco Email, Web, and/or Content Security Management appliances? [N]> Y
Do you want this appliance to display detailed analysis reports for files uploaded to the cloud from other appliances in your organization, 
and vice-versa? 
[Y]> Enter an Analysis Group name. This name is case-sensitive and must be configured identically on each appliance in the Analysis Group.
[]> FA_Reporting
Registration is successful with the group name. This does not require commit
File Reputation: Enabled
File Analysis: Enabled
File types selected for File Analysis:
    Microsoft Windows / DOS Executable
Appliance Group ID/Name: FA_Reporting
Choose the operation you want to perform:
- SETUP - Configure Advanced-Malware protection service.
- ADVANCED - Set values for AMP parameters (Advanced configuration).
- VIEWGROUP - view the group members details.
- CLEARCACHE - Clears the local File Reputation cache.
[]>

注	在配置设备组后，无法使用 setgroup 子命令。如果出于任何原因需要修改组，必须通过 Cisco TAC 创建案例。您可以使用 viewgroup 子命令查看设备组的详细信息。

mail.example.com> ampconfig
File Reputation: Enabled
File Analysis: Enabled
File types selected for File Analysis:
    Microsoft Windows / DOS Executable
Choose the operation you want to perform:
- SETUP - Configure Advanced-Malware protection service.
- ADVANCED - Set values for AMP parameters (Advanced configuration).
- SETGROUP - Add this appliance to the group of appliances that can share File Analysis reporting details.
- CLEARCACHE - Clears the local File Reputation cache.
[]> advanced
Enter cloud query timeout?
[15]>
Choose a file reputation server:
1. AMERICAS (cloud-sa.amp.sourcefire.com)
2. Private reputation cloud
[1]> 
Enter cloud domain?
[a.immunet.com]>
Do you want use the recommended analysis threshold from cloud service? [Y]> 
Enter analysis threshold?
[50]>
Enter heartbeat interval?
[15]> 
Do you want to enable SSL communication (port 443) for file reputation? [N]> 
Do you want to suppress the verdict update alerts for all messages that are 
not delivered to the recipient? [N]>
Choose a file analysis server:
1. AMERICAS (https://panacea.threatgrid.com)
2. Private Cloud
[1]> 2
Enter file analysis server url?
[]> https://mycloud.example.com
Certificate Authority:
1. Use Cisco Trusted Root Certificate List
2. Paste certificate to CLI
[1]>
File Reputation: Enabled
File Analysis: Enabled
File types selected for File Analysis:
    Microsoft Windows / DOS Executable
Choose the operation you want to perform:
- SETUP - Configure Advanced-Malware protection service.
- ADVANCED - Set values for AMP parameters (Advanced configuration).
- SETGROUP - Add this appliance to the group of appliances that can share File Analysis reporting details.
- CLEARCACHE - Clears the local File Reputation cache.
[]>

mail.example.com> ampconfig
File Reputation: Enabled
File Analysis: Enabled
File types selected for File Analysis:
    Microsoft Windows / DOS Executable
Appliance Group ID/Name: Not part of any group yet
Choose the operation you want to perform:
- SETUP - Configure Advanced-Malware protection service.
- ADVANCED - Set values for AMP parameters (Advanced configuration).
- SETGROUP - Add this appliance to the group of appliances that can share File
Analysis reporting details.
- CLEARCACHE - Clears the local File Reputation cache.
[]> advanced
Enter cloud query timeout?
[15]> 
Choose a file reputation server:
1. AMERICAS (cloud-sa.amp.domain.com)
2. Private reputation cloud
[1]> 2
Enter AMP reputation server hostname or IP address?
[]> myamp.domain.com
Paste the public key followed by a . on a new line
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqGKukO1De7zhZj6+H0qtjTkVxwTCpvKe4eCZ0
FPqri0cb2JZfXJ/DgYSF6vUpwmJG8wVQZKjeGcjDOL5UlsuusFncCzWBQ7RKNUSesmQRMSGkVb1/
3j+skZ6UtW+5u09lHNsj6tQ51s1SPrCBkedbNf0Tp0GbMJDyR4e9T04ZZwIDAQAB
-----END PUBLIC KEY-----
.
Enter cloud domain?
[immunet.com]> 
Do you want use the recommended analysis threshold from cloud service? [Y]> 
Enter heartbeat interval?
[15]> 
Do you want to enable SSL communication (port 443) for file reputation? [N]> 
Choose a file analysis server:
1. AMERICAS (https://threatgrid.com)
2. Private analysis cloud
[1]> 
File Reputation: Enabled
File Analysis: Enabled
File types selected for File Analysis:
    Microsoft Windows / DOS Executable
Appliance Group ID/Name: Not part of any group yet
Choose the operation you want to perform:
- SETUP - Configure Advanced-Malware protection service.
- ADVANCED - Set values for AMP parameters (Advanced configuration).
- SETGROUP - Add this appliance to the group of appliances that can share File
Analysis reporting details.
- CLEARCACHE - Clears the local File Reputation cache.
[]> 

mail.example.com> ampconfig
File Reputation: Enabled
File Analysis: Enabled
File types selected for File Analysis:
    Microsoft Windows / DOS Executable
Choose the operation you want to perform:
- SETUP - Configure Advanced-Malware protection service.
- ADVANCED - Set values for AMP parameters (Advanced configuration).
- SETGROUP - Add this appliance to the group of appliances that can share File Analysis reporting details.
- CLEARCACHE - Clears the local File Reputation cache.
[]> clearcache
Do you want to clear File Reputation Cache? [N]> y
Cache cleared successfully.
File Reputation: Enabled
File Analysis: Enabled
File types selected for File Analysis:
    Microsoft Windows / DOS Executable
Choose the operation you want to perform:
- SETUP - Configure Advanced-Malware protection service.
- ADVANCED - Set values for AMP parameters (Advanced configuration).
- SETGROUP - Add this appliance to the group of appliances that can share File Analysis reporting details.
- CLEARCACHE - Clears the local File Reputation cache.
[]>

在下面的示例中，modifytimeout 子命令用于配置恶意文件的缓存有效期。

注	缓存有效期的值必须介于 15 分钟到 7 天之间。

mail.example.com> ampconfig
File Reputation: Enabled
File Analysis: Enabled
File types selected for File Analysis:
    Microsoft Windows / DOS Executable
Appliance Group ID/Name: Not part of any group yet
Choose the operation you want to perform:
- SETUP - Configure Advanced-Malware protection service.
- ADVANCED - Set values for AMP parameters (Advanced configuration).
- SETGROUP - Add this appliance to the group of appliances that can share File Analysis reporting details.
- CACHESETTINGS - Configure the cache settings for AMP.
[]> cachesettings
Choose the operation you want to perfrom:
- MODIFYTIMEOUT - Configure the cache expiry period based on File Reputation disposition.
- CLEARCACHE - Clears the local File Reputation cache.
[]> modifytimeout
Choose the operation you want to perform:
- CLEAN - Configure the cache expiry period for clean files.
- MALICIOUS - Configure the cache expiry period for malicious files.
- UNKNOWN - Configure the cache expiry period for unknown files.
[]> malicious
Specify the cache expiry period for this file disposition (use 'd' for days, 'h' for hours, or 'm' for minutes). If you 
specify a value without a unit, it is always treated as days.
[1d]> 5d

显示各种高级恶意软件防护（文件信誉和分析）组件的版本。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail.example.com> ampstatus
Component                           Version    Last Updated
AMP Client Settings                 1.0        Never updated
AMP Client Engine                   1.0        Never updated

配置反垃圾邮件策略。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

以下示例演示反垃圾邮件功能的配置过程。

mail3.example.com> antispamconfig
Choose the operation you want to perform:
- IRONPORT - Configure IronPort Anti-Spam.
- CLOUDMARK - Configure Cloudmark Service Provider Edition.
- MULTISCAN - Configure IronPort Intelligent Multi-Scan.
[]> ironport
IronPort Anti-Spam scanning: Disabled
Choose the operation you want to perform:
- SETUP - Edit IronPort Anti-Spam settings.
[]> setup
IronPort Anti-Spam scanning: Disabled
Would you like to use IronPort Anti-Spam scanning? [Y]> y
The IronPort Anti-Spam License Agreement is displayed (if you have not already accepted it).
Do you accept the above IronPort Anti-Spam license agreement? []> Y
Increasing the following size settings may result in decreased performance. Please consult documentation for size 
recommendations based on your environment.
Never scan message larger than: (Add a trailing K for kilobytes, M for megabytes, or no letters for bytes.)
[1M]>
Always scan message smaller than: (Add a trailing K for kilobytes, M for megabytes, or no letters for bytes.)
[512K]>
Please specify the IronPort Anti-Spam scanning timeout (in seconds)
[60]>
Would you like to enable regional scanning? [N]>
IronPort Anti-Spam scanning is now enabled on the system. Please note: you must issue the 'policyconfig' command (CLI) 
or Mail Policies (GUI) to configure
Cisco IronPort scanning behavior for default and custom Incoming and Outgoing Mail Policies. This is recommended for your DEFAULT policy.
IronPort Anti-Spam scanning: Enabled
Choose the operation you want to perform:
- SETUP - Edit IronPort Anti-Spam settings.
[]>

显示反垃圾邮件状态。

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

mail3.example.com> antispamstatus
Choose the operation you want to perform:
- IRONPORT - Display IronPort Anti-Spam version and rule information.
- CLOUDMARK - Display Cloudmark Service Provider Edition version and rule information.
- MULTISCAN - Display Intelligent Multi-Scan version and rule information.
[]> ironport
  Component              Last Update                  Version
 CASE Core Files        Never updated                3.4.0-013
 CASE Utilities         Never updated                3.4.0-013
 Structural Rules       Never updated 3.3.1-009-20141210_214201
 Web Reputation DB      Never updated                20141211_111021
 Web Reputation Rules   Never updated 20141211_111021-20141211_170330
 Content Rules          Never updated                unavailable
 Content Rules Update   Never updated                unavailable
Last download attempt made on: Never

手动请求即时更新反垃圾邮件规则和相关案例组件。这也包括反垃圾邮件规则和智能多重扫描 (IMS) 使用的案例组件，但不适用于 IMS 使用的第三方反垃圾邮件引擎。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。它被进一步限制为在登录主机（例如，您登录的特定计算机）上使用。

批处理命令：此命令不支持批处理格式。

mail3.example.com> antispamupdate
Choose the operation you want to perform:
- MULTISCAN - Request updates for Intelligent Multi-Scan
- IRONPORT - Request updates for IronPort Anti-Spam
- CLOUDMARK - Request updates for Cloudmark Anti-Spam
[]> ironport
Requesting check for new CASE definitions

使用 incomingrelayconfig 命令可以启用并配置传入中继功能。在下面的示例中，会首先启用传入中继功能，然后添加两个中继，对其中一个进行修改，将另一个删除。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

配置最终用户安全列表/阻止列表。

注	必须通过 GUI 在设备上启用安全列表/阻止列表，才能运行此命令。

提交：此命令不需要“提交”。

批处理命令：此命令支持批处理格式。

使用指定文件中的条目替换最终用户安全列表/阻止列表中的所有条目。

slblconfig import <filename> <ignore invalid entries>

• filename - 必须导入的文件的名称。该文件必须位于设备上的 /configuration 目录中。
• ignore invalid entries - 是否忽略无效的条目。选择“是 (Yes)”或“否 (No)”。

将最终用户安全列表/阻止列表中的所有条目导出到设备上的文件。

slblconfig export

设备使用以下命名约定将 .CSV 文件保存到 /configuration 目录：

slbl<timestamp><serial number>.csv.

mail.example.com> 
slblconfig
End-User Safelist/Blocklist: Enabled
Choose the operation you want to perform:
- IMPORT - Replace all entries in the End-User Safelist/Blocklist.
- EXPORT - Export all entries from the End-User Safelist/Blocklist.
[]> 
import
Currently available End-User Safelist/Blocklist files:
1. slbl.csv
Choose the file to import from.
[1]> 
1
Do you want to ignore invalid entries? [Y]> 
Y
End-User Safelist/Blocklist import has been initiated...
Please wait while this operation executes.
End-User Safelist/Blocklist successfully imported.
Choose the operation you want to perform:
- IMPORT - Replace all entries in the End-User Safelist/Blocklist.
- EXPORT - Export all entries from the End-User Safelist/Blocklist.
[]> 

配置灰色邮件检测和安全取消订阅全局设置。

注	要启用灰色邮件检测和安全取消订阅，必须全局启用反垃圾邮件扫描。这可以是 IronPort 反垃圾邮件或智能多重扫描功能。

要为灰色邮件检测和安全取消订阅配置策略设置，请使用 policyconfig 命令。有关详细信息，请参阅创建传入策略以丢弃标识为大宗邮件或社交网络邮件的邮件。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令支持批处理格式。有关详细信息，请键入命令 help graymailconfig 参阅联机帮助。

Graymail Detection: Disabled

Choose the operation you want to perform:
- SETUP - Configure Graymail.
[]> setup

Would you like to use Graymail Detection? [Y]>

Increasing the following size settings may result in decreased performance.
Please consult documentation for size recommendations based on your
environment.

Maximum Message Size to Scan (Add a trailing K for kilobytes, M for megabytes,
or no letters for bytes.):
[1M]>

Timeout for Scanning Single Message(in seconds):
[60]>

Would you like to enable automatic updates for Graymail engine? [Y]> Y

Graymail Safe Unsubscribe: Disabled

Would you like to use Graymail Safe Unsubscribe? [Y]>

Graymail Detection and Safe Unsubscribe is now enabled. Please note: The global
settings are recommended only for your DEFAULT mail policy. To configure policy
settings, use the incoming or outgoing policy page on web interface or the
'policyconfig' command in CLI.

显示现有灰色邮件规则的详细信息。

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式

mail.example.com> graymailstatus
Component            Version         Last Updated
Graymail Engine      01.378.53       Never Updated
Graymail Rules       01.378.53#15    Never updated
Graymail Tools       1.0.03          Never updated

手动请求更新灰色邮件规则。

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式

mail.example.com> graymailupdate

Requesting check for new Graymail updates.

配置防病毒策略。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

在下面的示例中，antivirusconfig 命令用于在系统上启用 Sophos 病毒扫描，并将超时值设为 60 秒。要配置更新服务器、更新间隔和可选的代理服务器，请参阅updateconfig。

注	如果您在执行 systemsetup 命令期间未接受许可，则在首次调用 antivirusconfig 命令时，系统会向您显示许可协议，如果您未接受许可协议，在该设备上将不会启用 Sophos 病毒扫描引擎。

mail3.example.com> antivirusconfig

Choose the operation you want to perform:
- SOPHOS - Configure Sophos Anti-Virus.
- MCAFEE - Configure McAfee Anti-Virus.
[]> sophos

Sophos Anti-Virus: Disabled

Choose the operation you want to perform:

- SETUP - Configure Sophos Anti-Virus.

[]> setup

Sophos Anti-Virus scanning: Disabled

Would you like to use Sophos Anti-Virus scanning? [Y]> y

(First time users see the license agreement displayed here.)

Please specify the Anti-Virus scanning timeout (in seconds)
[60]> 60

Would you like to enable automatic updates for Sophos engine? [Y] > Y

Sophos Anti-Virus scanning is now enabled on the system.

Please note: you must issue the 'policyconfig' command (CLI) or Mail
Policies (GUI) to configure Sophos Anti-Virus scanning behavior for default and custom Incoming and Outgoing Mail Policies.
This is recommended for your DEFAULT policy.

Sophos Anti-Virus: Enabled
Choose the operation you want to perform:

- SETUP - Configure Sophos Anti-Virus.
[]>

AsyncOS 会提供设备已经下载的特定防病毒签名文件（IDE 文件）的详细状态。您可以使用 antivirusconfig -> detail 子命令访问这些详细信息。例如：

mail3.example.com> antivirusconfig
Choose the operation you want to perform:
- SOPHOS - Configure Sophos Anti-Virus.
- MCAFEE - Configure McAfee Anti-Virus.
[]> sophos
Sophos Anti-Virus: Enabled
Choose the operation you want to perform:
- SETUP - Configure Sophos Anti-Virus.
- STATUS - View Sophos Anti-Virus status.
- DETAIL - View Sophos Anti-Virus detail.
[]> detail
Sophos Anti-Virus:
Product - 3.87
Engine - 2.25.0
Product Date - 01 Nov 2004
Sophos IDEs currently on the system:
   'Mkar-E.Ide'           Virus Sig. - 23 Dec 2004 01:24:02
   'Rbot-Sd.Ide'          Virus Sig. - 22 Dec 2004 19:10:06
   'Santy-A.Ide'          Virus Sig. - 22 Dec 2004 06:16:32
   'Bacbanan.Ide'         Virus Sig. - 21 Dec 2004 18:33:58
   'Rbot-Sb.Ide'          Virus Sig. - 21 Dec 2004 14:50:46
   'Rbotry.Ide'           Virus Sig. - 21 Dec 2004 06:13:40
   'Sdbot-Si.Ide'         Virus Sig. - 20 Dec 2004 20:52:04
   'Oddbob-A.Ide'         Virus Sig. - 19 Dec 2004 23:34:06
   'Rbot-Rw.Ide'          Virus Sig. - 19 Dec 2004 00:50:34
   'Wortd.Ide'            Virus Sig. - 18 Dec 2004 07:02:44
   'Delf-Jb.Ide'          Virus Sig. - 17 Dec 2004 22:32:08
[...command continues...]

显示防病毒状态。

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

mail3.example.com> antivirusstatus
Choose the operation you want to perform:
- MCAFEE - Display McAfee Anti-Virus version information
- SOPHOS - Display Sophos Anti-Virus version information
[]> sophos
    SAV Engine Version        3.85
    IDE Serial                2004101801
 Engine Update        Mon Sep 27 14:21:25 2004
    Last IDE Update           Mon Oct 18 02:56:48 2004
    Last Update Attempt       Mon Oct 18 11:11:44 2004
    Last Update Success       Mon Oct 18 02:56:47 2004

手动更新病毒定义。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。它被进一步限制为在登录主机（例如，您登录的特定计算机）上使用。

批处理命令：此命令不支持批处理格式。

mail3.example.com> antivirusupdate
Choose the operation you want to perform:
- MCAFEE - Request updates for McAfee Anti-Virus
- SOPHOS - Request updates for Sophos Anti-Virus
[]> sophos
Requesting update of virus definitions
mail3.example.com>

提交更改。您可以选择在 commit 命令后输入评论。

提交：N/A

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

mail3.example.com> commit
Please enter some comments describing your changes:
[]> Changed "psinet" IP Interface to a different IP ad dress
Do you want to save the current configuration for rollback? [Y]> n
Changes committed: Fri May 23 11:42:12 2014 GMT

显示最近一次提交的详细信息。

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

mail3.example.com> commitdetail
Commit at Mon Apr 18 13:46:28 2005 PDT with comments: "Enabled loopback".
mail3.example.com>

clear 命令会清除自上次发出 commit 或 clear 命令后所做的所有配置更改。

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式

mail3.example.com> clear
Are you sure you want to clear all changes since the last commit?  [Y]> y
Changes cleared: Mon Jan 01 12:00:01 2003
mail3.example.com>

help 命令会列出所有可用的 CLI 命令，并为每个命令提供简短说明。要调用 help 命令，可以在命令提示符中键入 help 或一个问号 (?)。

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式

mail3.example.com> help
Displays the list of all available commands.

提交：此命令需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail.example.com> rollbackconfig
Previous Commits:
    Committed On                  User                Description
---------------------------------------------------------------------------------
1. Fri May 23 06:53:43 2014      admin               new user
2. Fri May 23 06:50:57 2014      admin               rollback
3. Fri May 23 05:47:26 2014      admin
4. Fri May 23 05:45:51 2014      admin               edit user
Enter the number of the config to revert to.
[]> 2
Are you sure you want to roll back the configuration? [N]> y
Reverted to Fri May 23 06:50:57 2014      admin               rollback
Do you want to commit this configuration now? [N]> y
Committed the changes successfully

quit 命令可以让您从 CLI 应用注销。系统会清除尚未提交的配置更改。quit 命令不会影响邮件操作。系统将注销记录在日志文件中。（键入 exit 等同于键入 quit。）

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式

mail3.example.com> quit
Configuration changes entered but not committed.  Exiting will lose changes.
Type 'commit' at the command prompt to commit changes.
Are you sure you wish to exit?  [N]> Y

加载配置文件。

注	仅使用 GUI 才支持在加入群集的计算机上加载配置。有关说明，请参阅《思科邮件安全设备 AsyncOS 用户指南》。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式

在本示例中，新的配置文件从本地位置导入。

mail3.example.com> loadconfig
1. Paste via CLI
2. Load from file
[1]> 2
Enter the name of the file to import:
[]> changed.config.xml
Values have been loaded.
Be sure to run "commit" to make these settings active.
mail3.example.com> commit
Please enter some comments describing your changes:
[]> loaded new configuration file
Do you want to save the current configuration for rollback? [Y]> n
Changes committed: Fri May 23 11:42:12 2014 GMT

在此示例中，直接在命令行粘贴新配置文件。（请记得在空白行输入 Control-D 以结束粘贴命令。）然后，使用“系统设置向导”(System Setup wizard) 更改默认主机名、IP 地址以及默认网关信息。最后，提交更改。

mail3.example.com> loadconfig
1. Paste via CLI
2. Load from file
[1]> 1
Paste the configuration file now.
Press CTRL-D on a blank line when done.
[The configuration file is pasted until the end tag 
</config>
. Control-D is entered on a separate line.] 
Values have been loaded.
Be sure to run "commit" to make these settings active.
mail3.example.com> systemsetup
[The system setup wizard is run.]
mail3.example.com> commit
Please enter some comments describing your changes:
[]> pasted new configuration file and changed default settings via 
systemsetup 
Do you want to save the current configuration for rollback? [Y]> n
Changes committed: Fri May 23 11:42:12 2014 GMT

要测试配置，您可以立即使用 mailconfig 命令发送包含系统配置数据（刚刚用 systemsetup 命令创建）的测试邮件。

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式

mail.example.com> mailconfig
Please enter the email address to which you want to send the configuration file.
Separate multiple addresses with commas.
[]> user@example.com
Choose the passphrase option:
1. Mask passphrases (Files with masked passphrases cannot be loaded using loadconfig command)
2. Encrypt passphrases
3. Plain passphrases
[1]> 2
The configuration file has been sent to user@example.com.

将配置发送到您有权访问的邮箱，以确认系统能够在您的网络中发送邮件。

注	为了增强安全性，如果设备中的敏感数据加密已在 ipsconfig 命令中启用，则您无法使用 Plain passwords 选项。

当对设备进行物理传输时，您可能希望从出厂默认值开始。r esetconfig 命令会将所有配置值重置为出厂默认设置。此命令极具破坏性，只有当您传输设备或解决配置问题万不得已时方可使用。我们建议，在运行 resetconfig 命令后，请在重新连接到 CLI 后运行 systemsetup 命令。

注	仅当设备处于离线状态时，resetconfig 命令才有效。当 resetconfig 命令完成时，设备会自动返回到联机状态，即使之后您再次运行 systemsetup 命令也如此。如果在发出 resetconfig 命令之前邮件传输已暂停，则当 resetconfig 命令完成时，将尝试再次传输邮件。

危险	resetconfig 命令会将所有网络设置恢复为出厂默认设置，这可能会断开您与 CLI 的连接，禁用连接设备所用的服务（FTP、Telnet、SSH、HTTP、HTTPS），甚至删除您使用 userconfig 命令创建的其他用户帐户。如果您无法通过默认“管理员”(Admin) 用户帐户使用串行接口或管理端口上的默认设置重新连接到 CLI，请勿使用此命令。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。它被进一步限制为在登录主机（例如，您登录的特定计算机）上使用。此命令需要访问本地文件系统。

批处理命令：此命令不支持批处理格式。

mail3.example.com> suspend
Delay (seconds, minimum 30):
[30]> 45
Waiting for listeners to exit...
Receiving suspended.
Waiting for outgoing deliveries to finish...
Mail delivery suspended.
mail3.example.com> 
resetconfig
Are you sure you want to reset all configuration values? [N]> Y
All settings have been restored to the factory default.

saveconfig 命令会将具有唯一文件名的配置文件保存到 configuration 目录。

注	如果您是位于群集环境中，则此命令会保存完整的群集配置。要在群集计算机上运行此命令，请将您的配置模式更改为群集。

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式

在下面的示例中，配置文件中的密码短语将加密并保存在 configuration 目录中。

mail.example.com> saveconfig
Choose the passphrase option:
1. Mask passphrases (Files with masked passphrases cannot be loaded using loadconfig command)
2. Encrypt passphrases

[1]> 2
File written on machine "mail.example.com" to the location
"/configuration/C100V-4232116C4E14C70C4C7F-7898DA3BD955-20140319T050635.xml".
Configuration saved.

注	为了增强安全性，如果设备中的敏感数据加密已在 ipsconfig 命令中启用，则您无法使用 Plain passwords 选项。

showconfig 命令可将当前配置打印到屏幕。

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式

在下面的示例中，配置显示在 CLI 上，配置中的密码短语会加密。

mail.example.com> showconfig
Choose the passphrase display option:
1. Mask passphrases (Files with masked passphrases cannot be loaded using loadconfig command)
2. Encrypt passphrases
3. Plain passphrases
[1]> 2
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE config SYSTEM "config.dtd">
<!--
  Product: Cisco C100V Email Security Virtual Appliance
  Model Number: C100V
  Version: 9.0.0-038
  Serial Number: 4232116C4E14C70C4C7F-7898DA3BD955
  Number of CPUs: 2
  Memory (MB): 6144
  Current Time: Wed Mar 19 05:30:05 2014
-->
<config>
<!--
******************************************************************************
*                           Network Configuration                            *
******************************************************************************
-->[The remainder of the configuration file is printed to the screen.]

注	为了增强安全性，如果设备中的敏感数据加密已在 ipsconfig 命令中启用，则您无法使用 Plain passwords 选项。

clusterconfig 命令用于配置群集相关的设置。如果此计算机不是群集的一部分，运行 clusterconfig 将使您可以选择，是加入群集还是创建新群集。

clusterconfig 命令提供附加的子命令：

非群集命令

当您不在群集时，以下命令可用。

• clusterconfig new <name> - 这将使用给定的名称创建新的群集。此计算机将是此群集的成员和名为“Main Group”的默认群集组的成员。

  <name> - 新群集的名称。

• clusterconfig join [--port=xx] <ip_of_remote_cluster> [<admin_password>]<groupname> - 这会将此计算机添加到群集。

  其中：

  <ip_of_remote_cluster> - 群集中另一台计算机的 IP 地址。

  <admin_password > - 群集的管理员密码。如果

  通过 CCS 加入，则不应指定此密码。

  <groupname> - 要加入的组的名称。

  <port> - 要连接的远程计算机的端口（默认为 22）。

• clusterconfig prepjoin print

  这将显示准备通过 CCS 端口将此计算机加入群集所需的信息。

群集命令

当您在群集中时，以下命令可用。

• clusterconfig addgroup <groupname> - 创建新的群集组。此组最初没有成员。
• clusterconfig renamegroup <old_groupname> <new_groupname> - 更改群集组的名称。

• clusterconfig deletegroup <groupname> [new_groupname] - 删除群集组。

  <groupname> - 要删除的群集组的名称。

  <new_groupname> - 要将旧群集组中的计算机放入其中的群集组。

• clusterconfig setgroup <machinename> <groupname> - 设置（更改）某个计算机所属的组。

  <machinename > - 要设置的计算机的名称。

  <groupname> - 要计算机设置到其中的组。

• clusterconfig removemachine <machinename> - 从群集中删除计算机。
• clusterconfig setname <name> - 将群集的名称更改为指定名称。
• clusterconfig list - 显示群集中当前所有的计算机。
• clusterconfig connstatus - 显示群集中当前所有的计算机，并为断开连接的计算机添加路由详细信息。

• clusterconfig disconnect <machinename> - 此命令会临时将计算机从群集中断开。

  <machinename> - 要断开连接的计算机的名称。

• clusterconfig reconnect <machinename> - 这将会恢复被“disconnect”命令断开连接的计算机的连接。

• clusterconfig prepjoin new <serial_number> <hostname> <user_key> - 这将会添加一个新主机，该新主机将通过 CCSport 加入群集。

  <serial_number> - 要添加的计算机的序列号。

  <hostname> - 要添加的计算机的主机名。

  <user_key> - 来自加入计算机的“prepjoin print”命令的 SSH 用户密钥。

• clusterconfig prepjoin delete <serial_number|hostname> - 这行命令会删除以前通过“prepjoin new”命令指定为要添加的主机。如果您稍后决定不添加该主机，则只需要使用这一行命令。当主机成功添加到群集时，会自动删除它的 prepjoin 信息。

提交：此命令不需要“提交”。

群集管理：此命令仅限在群集模式下使用。

批处理命令：此命令不支持批处理格式。

有关 clusterconfig 命令及其使用的说明，请参阅《思科邮件安全设备 AsyncOS 用户指南》。

提交：此命令不需要“提交”。

群集管理：此命令可以用于群集、分组或计算机模式中。

批处理命令：此命令不支持批处理格式。

mail.example.com> dlpstatus

Component 								     Version    Last Updated
DLP Engine            3.0.2.31   Never updated

更新 DLP 引擎。

注	必须通过 GUI 中的 DLP 全局设置 (Global Settings) 页配置 DLP 后，才能使用 dlpupdate 命令。

提交：此命令不需要“提交”。

群集管理：此命令可以用于群集、分组或计算机模式中。

批处理命令：此命令支持批处理格式。

即便没有检测到更改，dlpupdate 命令的批处理格式也会强制更新 DLP 引擎。

dlpupdate [force]

mail.example.com> dlpupdate

Checking for available updates. This may take a few seconds..

Could not check for available updates. Please check your Network and Service Updates settings and retry.

Choose the operation you want to perform:

- SETUP - Enable or disable automatic updates for DLP Engine.

[]> setup

Automatic updates for DLP are disabled

Do you wish to enable automatic updates for DLP Engine? [N]> y

Choose the operation you want to perform:

- SETUP - Enable or disable automatic updates for DLP Engine.

[]>

配置 S/MIME 设置，例如发送配置文件、管理公共密钥等。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

• 创建一个发送配置文件以便进行签名和加密
• 添加公共密钥以便进行加密

配置 DomainKeys/DKIM 支持。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令支持批处理格式。

注	为了增强安全性，如果已在 FIPS 模式下启用设备敏感数据加密，则您将无法查看私钥。如果想要编辑私钥，可以输入现有的私钥或生成新的私钥。

domainkeysconfig 命令的批处理格式可以用于创建、编辑或者删除签名配置文件。

• 添加 DomainKeys/DKIM 签名配置文件：

  domainkeysconfig profiles signing new <name> <type> <domain> <selector> <user-list> [options]

• 编辑签名配置文件：

  domainkeysconfig profiles signing edit <name> [signing-profile-options]

签名配置文件选项：

• rename <name>
• domain <domain>
• selector <selector>
• canonicalization <canon>
• canonicalization <header_canon> <body_canon>
• key <key_name>
• bodylength <body_length>
• headerselect <header_select>
• customheaders <custom_headers>
• itag <i_tag> [<agent_identity>]
• qtag <q_tag>
• ttag <t_tag>
• xtag <x_tag> [<expiration_time>]
• ztag <z_tag>
• new <user-list>
• delete <user-list>
• print
• clear

• 删除签名配置文件：

  domainkeysconfig profiles signing delete <name>

• 显示配置文件列表：

  domainkeysconfig profiles signing list

• 打印签名配置文件的详细信息：

  domainkeysconfig profiles signing print <name>

• 测试签名配置文件：

  domainkeysconfig profiles signing test <name>

• 导入签名配置文件的本地副本：

  domainkeysconfig profiles signing import <filename>

• 从设备导出签名配置文件的副本：

  domainkeysconfig profiles signing export <filename>

• 从设备删除所有签名配置文件：

  domainkeysconfig profiles signing clear

• 创建新的 DKIM 验证配置文件。

  domainkeysconfig profiles verification new <name> <verification-profile-options>

• 编辑验证配置文件：

  domainkeysconfig profiles verification edit <name> <verification-profile-options>

• 删除验证配置文件：

  domainkeysconfig profiles verification delete <name>

• 打印现有验证配置文件的详细信息：

  domainkeysconfig profiles verification print <name>

• 显示现有验证配置文件的列表：

  domainkeysconfig profiles verification list

• 从本地计算机导入验证配置文件：

  domainkeysconfig profiles verification import <filename>

• 从设备导出验证配置文件：

  domainkeysconfig profiles verification export <filename>

• 从设备删除所有现有验证配置文件：

  domainkeysconfig profiles verification clear

• 创建新的签名密钥：

  domainkeysconfig keys new <key_name> <key-options>

• 编辑签名密钥：

  domainkeysconfig keys edit <key_name> key <key-options>

• 重命名现有签名密钥：

  domainkeysconfig keys edit <key_name> rename <key_name>

• 指定公钥：

  domainkeysconfig keys publickey <key_name>

• 删除密钥：

  domainkeysconfig keys delete <key_name>

• 显示所有签名密钥的列表：

  domainkeysconfig keys list

• 显示有关指定签名密钥的所有信息：

  domainkeysconfig keys print <key_name>

• 从本地计算机导入签名密钥：

  domainkeysconfig keys import <filename>

• 从设备导出签名密钥：

  domainkeysconfig keys export <filename>

• 删除设备上的所有签名密钥：

  domainkeysconfig keys clear

• 搜索配置文件签名密钥：

  domainkeysconfig search <search_text>

• 为设备上的域密钥/DKIM 修改全局设置。

  domainkeysconfig setup <setup_options>

可用的选项如下：

• --sign_generated_msgs - 指定是否对系统生成的邮件签名。可能的值包括 yes 或 no。

mail3.example.com> domainkeysconfig
Number of DK/DKIM Signing Profiles: 1
Number of Signing Keys: 1
Number of DKIM Verification Profiles: 1
Sign System-Generated Messages: Yes
Choose the operation you want to perform:
- PROFILES - Manage domain profiles.
- KEYS - Manage signing keys.
- SETUP - Change global settings.
- SEARCH - Search for domain profile or key.
[]> profiles
Choose the operation you want to perform:
- SIGNING - Manage signing profiles.
- VERIFICATION - Manage verification profiles.
[]> signing
There are currently 1 domain profiles defined.
Choose the operation you want to perform:
- NEW - Create a new domain profile.
- EDIT - Modify a domain profile.
- DELETE - Delete a domain profile.
- PRINT - Display domain profiles.
- LIST - List domain profiles.
- TEST - Test if a domain profile is ready to sign.
- DNSTXT - Generate a matching DNS TXT record.
- IMPORT - Import domain profiles from a file.
- EXPORT - Export domain profiles to a file.
- CLEAR - Clear all domain profiles.
[]> dnstxt
Enter the name or number of a domain profile.
1. Example
[1]>
The answers to the following questions will be used to construct DKIM text
record for DNS.  It can be used to publish information about this profile.
Do you wish to constrain the local part of the signing identities
("i=" tag of "DKIM-Signature" header field) associated with this
domain profile? [N]>
Do you wish to include notes that may be of interest to a human (no
interpretation is made by any program)? [N]>
The "testing mode" can be set to specify that this domain is testing DKIM and
that unverified email must not be treated differently from verified email.
Do you want to indicate the "testing mode"? [N]>
Do you wish to disable signing by subdomains of this domain? [N]>
The DKIM DNS TXT record is:
test._domainkey.example.com. IN TXT "v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDX5dOG9J8rXreA/uPtYr5lrCTCqR+qlS5Gm
1f0OplAzSuB2BvOnxZ5Nr+se0T+k7mYDP0FSUHyWaOvO+kCcum7fFRjS3EOF9gLpbIdH5vzOCKp/w7hdjPy3q6PSgJVtqvQ6v9E8k5Ui7C+DF6KvJUiMJSY5sbu2
zmm9rKAH5m7FwIDAQAB;"
There are currently 1 domain profiles defined.
Choose the operation you want to perform:
- NEW - Create a new domain profile.
- EDIT - Modify a domain profile.
- DELETE - Delete a domain profile.
- PRINT - Display domain profiles.
- LIST - List domain profiles.
- TEST - Test if a domain profile is ready to sign.
- DNSTXT - Generate a matching DNS TXT record.
- IMPORT - Import domain profiles from a file.
- EXPORT - Export domain profiles to a file.
- CLEAR - Clear all domain profiles.
[]>
Choose the operation you want to perform:
- SIGNING - Manage signing profiles.
- VERIFICATION - Manage verification profiles.
[]>
Number of DK/DKIM Signing Profiles: 1
Number of Signing Keys: 1
Number of DKIM Verification Profiles: 1
Sign System-Generated Messages: Yes
Choose the operation you want to perform:
- PROFILES - Manage domain profiles.
- KEYS - Manage signing keys.
- SETUP - Change global settings.
- SEARCH - Search for domain profile or key.
[]>

配置 WAAS 设置

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令支持批处理格式。

dmarcconfig 的批处理格式可以用于创建、编辑或者删除验证配置文件并修改全局设置。

以下示例展示了如何设置 DMARC 验证配置文件并编辑 DMARC 验证配置文件的全局设置。

mail.example.com> dmarcconfig
Number of DMARC Verification Profiles: 1
Daily report generation time is: 00:00
Error reports enabled: No
Reports sent on behalf of:
Contact details for reports:
Send a copy of aggregate reports to: None Specified
Bypass DMARC verification for senders from addresslist: None Specified
Bypass DMARC verification for messages with header fields: None Specified
Choose the operation you want to perform:
- PROFILES - Manage DMARC verification profiles.
- SETUP - Change global settings.
[]> profiles
There are currently 1 DMARC verification profiles defined.
Choose the operation you want to perform:
- NEW - Create a new DMARC verification profile.
- EDIT - Modify a DMARC verification profile.
- DELETE - Delete a DMARC verification profile.
- PRINT - Display DMARC verification profiles.
- IMPORT - Import DMARC verification profiles from a file.
- EXPORT - Export DMARC verification profiles to a file.
- CLEAR - Clear all DMARC verification profiles.
[]> new
Enter the name of the new DMARC verification profile:
[]> dmarc_ver_profile_1
Select the message action when the policy in DMARC record is reject:
1. No Action
2. Quarantine the message
3. Reject the message
[3]> 1
Select the message action when the policy in DMARC record is quarantine:
1. No Action
2. Quarantine the message
[2]> 2
Select the quarantine for messages that fail DMARC verification (when the DMARC policy is quarantine).
1. Policy
[1]> 1
What SMTP action should be taken in case of temporary failure?
1. Accept
2. Reject
[1]> 2
Enter the SMTP response code for rejected messages in case of temporary failure.
[451]>
Enter the SMTP response text for rejected messages in case of temporary failure. Type DEFAULT to use the default response text 
'#4.7.1 Unable to perform
DMARC verification.'
[#4.7.1 Unable to perform DMARC verification.]>
What SMTP action should be taken in case of permanent failure?
1. Accept
2. Reject
[1]> 2
Enter the SMTP response code for rejected messages in case of permanent failure.
[550]>
Enter the SMTP response text for rejected messages in case of permanent failure. Type DEFAULT to use the default response text 
'#4.7.1 Unable to perform
DMARC verification.'
[#5.7.1 DMARC verification failed.]>
There are currently 2 DMARC verification profiles defined.
Choose the operation you want to perform:
- NEW - Create a new DMARC verification profile.
- EDIT - Modify a DMARC verification profile.
- DELETE - Delete a DMARC verification profile.
- PRINT - Display DMARC verification profiles.
- IMPORT - Import DMARC verification profiles from a file.
- EXPORT - Export DMARC verification profiles to a file.
- CLEAR - Clear all DMARC verification profiles.
[]>
Number of DMARC Verification Profiles: 2
Daily report generation time is: 00:00
Error reports enabled: No
Reports sent on behalf of:
Contact details for reports:
Send a copy of aggregate reports to: None Specified
Bypass DMARC verification for senders from addresslist: None Specified
Bypass DMARC verification for messages with header fields: None Specified
Choose the operation you want to perform:
- PROFILES - Manage DMARC verification profiles.
- SETUP - Change global settings.
[]> setup
Would you like to modify DMARC report settings? (Yes/No) [N]> y
Enter the time of day to generate aggregate feedback reports. Use 24-hour format (HH:MM).
[00:00]>
Would you like to send DMARC error reports? (Yes/No) [N]> y
Enter the entity name responsible for report generation. This is added to the DMARC aggregate reports.
[]> example.com
Enter additional contact information to be added to DMARC aggregate reports. This could be an email address, 
URL of a website with additional help, a phone number etc.
[]> http://dmarc.example.com
Would you like to send a copy of all aggregate reports?  (Yes/No) [N]>
Would you like to bypass DMARC verification for an addresslist? (Yes/No) [N]>
Would you like to bypass DMARC verification for specific header fields? (Yes/No) [N]> y
Choose the operation you want to perform:
- ADD - Add a header field to the verification-bypass list.
[]> add
Enter the header field name
[]> List-Unsubscribe
DMARC verification is configured to bypass DMARC verification for messages containing the following header fields.
1. List-Unsubscribe
Choose the operation you want to perform:
- ADD - Add a header field to the verification-bypass list.
- REMOVE - Remove a header field from the list.
[]> add
Enter the header field name
[]> List-ID
DMARC verification is configured to bypass DMARC verification for messages containing the following header fields.
1. List-Unsubscribe
2. List-ID
Choose the operation you want to perform:
- ADD - Add a header field to the verification-bypass list.
- REMOVE - Remove a header field from the list.
[]>
Number of DMARC Verification Profiles: 2
Daily report generation time is: 00:00
Error reports enabled: Yes
Reports sent on behalf of: example.com
Contact details for reports: http://dmarc.example.com
Send a copy of aggregate reports to: None Specified
Bypass DMARC verification for senders from addresslist: None Specified
Bypass DMARC verification for messages with header fields: List-Unsubscribe, List-ID
Choose the operation you want to perform:
- PROFILES - Manage DMARC verification profiles.
- SETUP - Change global settings.
[]>

在 DNS 服务器上查找记录

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令支持批处理格式。

dig 命令的批处理格式可以用于执行传统 CLI 命令的所有功能。

• 在 DNS 服务器上查找记录

  dig [options] [@<dns_ip>] [qtype] <hostname>

• 在 DNS 服务器上为特定 IP 地址执行反向查找

  dig -x <reverse_ip> [options] [@<dns_ip>]

下面是 dig 命令的批处理格式可用的选项

    -s <source_ip>  Specify the source IP address.

    -t              Make query over TCP.

    -u              Make query over UDP (default).

    dns_ip - Query the DNS server at this IP address.

    qtype - Query type: A, PTR, CNAME, MX, SOA, NS, TXT.

    hostname - Record that user want to look up.

    reverse_ip - Reverse lookup IP address.

    dns_ip - Query the DNS server at this IP address.

以下示例明确指定要进行查找的 DNS 服务器。

mail.com> dig @111.111.111.111 example.com MX
; <<>> DiG 9.4.3-P2 <<>> @111.111.111.111 example.com MX
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18540
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 3
;; QUESTION SECTION:
;example.com.                       IN      MX
;; ANSWER SECTION:
mexample.com.                10800   IN      MX      10 mexample.com.
;; AUTHORITY SECTION:
example.com.                     10800   IN      NS      test.example.com.
;; ADDITIONAL SECTION:
example.com. 10800 IN      A       111.111.111.111
example.com. 10800 IN      AAAA    2620:101:2004:4201::bd
example.com.   300     IN      A       111.111.111.111
;; Query time: 6 msec
;; SERVER: 10.92.144.4#53(10.92.144.4)
;; WHEN: Fri Dec  9 23:37:42 2011
;; MSG SIZE  rcvd: 143

注	如果在使用此命令时未明确指定 DNS 服务器，则 dig 命令会过滤掉 Authority 和 Additional 部分的信息。

配置 DNS 设置

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令支持批处理格式。

dnsconfig 命令的批处理格式可以用于执行传统 CLI 命令的所有功能。

• 配置 DNS 以使用本地名称服务器缓存：

  dnsconfig parent new <ns_ip> <priority>

命令参数：

• <ns_ip> - 名称服务器的 IP 地址。以逗号分隔多个 IP 地址。
• <priority> - 此条目的优先级。

• 删除本地名称服务器缓存：

  dnsconfig parent delete <ns_ip>

• 配置备用 DNS 缓存用于特定域︰

  dnsconfig alt new <domains> <ns_ip>

注	当使用互联网根名称服务器时，无法使用。

命令参数：

• <ns_ip> - 名称服务器的 IP 地址。以逗号分隔多个 IP 地址。
• <domains> - 逗号分隔的域列表。

• 删除特定域的备用 DNS 缓存：

  dnsconfig alt delete <domain>

• 配置 DNS 以使用互联网根名称服务器：

  dnsconfig roots new <ns_domain> <ns_name> <ns_ip>

名称服务器参数：

• <ns_domain> - 要覆盖的域。
• <ns_name> - 名称服务器的名称。
• <ns_ip> - 名称服务器的 IP 地址。

注	可以通过指定该域的备用名称服务器覆盖某些特定域。

• 删除名称服务器：

  dnsconfig roots delete <ns_domain> [ns_name]

注	当删除时，如果未指定 ns_name，则将删除该域的所有名称服务器。

• 清除所有 DNS 设置并将系统自动配置为使用互联网根服务器：

  dnsconfig roots

显示当前的 DNS 设置。

dnsconfig print

每个用户指定的 DNS 服务器需要以下信息：

• 主机名
• IP 地址
• （仅备用服务器）的域权威

在 dnsconfig 命令内可用的四个子命令：

new

delete

edit

setup

mail3.example.com> dnsconfig
Currently using the Internet root DNS servers.
Alternate authoritative DNS servers:
1. com: dns.example.com (10.1.10.9)
Choose the operation you want to perform:
- NEW - Add a new server.
- EDIT - Edit a server.
- DELETE - Remove a server.
- SETUP - Configure general settings.
[]> setup
Do you want the Gateway to use the Internet's root DNS servers or would you like
it to use your own DNS servers?
1. Use Internet root DNS servers
2. Use own DNS cache servers
[1]> 1
Choose the IP interface for DNS traffic.
1. Auto
2. Management (10.92.149.70/24: mail3.example.com)
[1]> 
Enter the number of seconds to wait before timing out reverse DNS lookups.
[20]> 
Enter the minimum TTL in seconds for DNS cache.
[1800]> 
Currently using the Internet root DNS servers.
Alternate authoritative DNS servers:
1. com: dns.example.com (10.1.10.9)
Choose the operation you want to perform:
- NEW - Add a new server.
- EDIT - Edit a server.
- DELETE - Remove a server.
- SETUP - Configure general settings.
[]> 

清除 DNS 缓存的所有条目。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式

mail3.example.com> dnsflush
Are you sure you want to clear out the DNS cache? [N]> Y

配置 IPv4/IPv6 DNS 首选项

提交：此命令需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式

mail3.example.com> dnshostprefs
Choose the operation you want to perform:
- NEW - Add new domain override.
- SETDEFAULT - Set the default behavior.
[]> new
Enter the domain you wish to configure.
[]> example.com
How should the appliance sort IP addresses for this domain?
1. Prefer IPv4
2. Prefer IPv6
3. Require IPv4
4. Require IPv6
[2]> 3
Choose the operation you want to perform:
- NEW - Add new domain override.
- SETDEFAULT - Set the default behavior.
[]> setdefault
How should the appliance sort IP addresses?
1. Prefer IPv4
2. Prefer IPv6
3. Require IPv4
4. Require IPv6
[2]> 1
Choose the operation you want to perform:
- NEW - Add new domain override.
- SETDEFAULT - Set the default behavior.
[]>

配置 DNS 列表服务支持

提交：此命令需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式

mail3.example.com> dnslistconfig
Current DNS List Settings:
Negative Response TTL:  1800 seconds
DNS List Query Timeout:  3 seconds
Choose the operation you want to perform:
- SETUP - Configure general settings.
[]> setup
Enter the cache TTL for negative responses in seconds:
[1800]> 1200
Enter the query timeout in seconds:
[3]>
Settings updated.
Current DNS List Settings:
Negative Response TTL:  1200 seconds
DNS List Query Timeout:  3 seconds
Choose the operation you want to perform:
- SETUP - Configure general settings.
[]>

对基于 DNS 的列表服务进行 DNS 查找测试。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式

mail3.example.com> dnslisttest
Enter the query server name:
[]> mail4.example.com
Enter the test IP address to query for:
[127.0.0.2]> 10.10.1.11
Querying:  10.10.1.11.mail4.example.com
Result:  MATCHED

显示 DNS 统计信息。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail3.example.com> dnsstatus
Status as of: Mon Apr 18 10:58:07 2005 PDT
Counters:                    Reset          Uptime        Lifetime
  DNS Requests               1,115           1,115           1,115
  Network Requests             186             186             186
  Cache Hits                 1,300           1,300           1,300
  Cache Misses                   1               1               1
  Cache Exceptions               0               0               0
  Cache Expired                185             185             185

addressconfig命令用于配置“发件人：”地址信头。您可以指定“发件人：”地址的显示、用户和域名称。您也可以选择将虚拟网关域用于域名。为 AsyncOS 生成的邮件使用 addressconfig 命令，用于以下环境：

• 防病毒通知
• 退回
• DMARC 反馈报告
• 通知（notify() 和 notify-copy() 过滤器操作）
• 隔离区邮件（和隔离区管理中的“发送副本”）
• 报告
• 其他所有邮件。

在下面的示例中，通知的“发件人：”地址从 Mail Delivery System [MAILER-DAEMON@domain]（默认）更改为 Notifications [Notification@example.com]

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

mail3.example.com> addressconfig
Current anti-virus from: "Mail Delivery System" <MAILER-DAEMON@domain>
Current bounce from: "Mail Delivery System" <MAILER-DAEMON@domain>
Current notify from: "Mail Delivery System" <MAILER-DAEMON@domain>
Current quarantine from: "Mail Delivery System" <MAILER-DAEMON@domain>
Current DMARC reports from: "DMARC Feedback" <MAILER-DAEMON@domain>
Current all other messages from: "Mail Delivery System" <MAILER-DAEMON@domain>
Choose the operation you want to perform:
- AVFROM - Edit the anti-virus from address.
- BOUNCEFROM - Edit the bounce from address.
- NOTIFYFROM - Edit the notify from address.
- QUARANTINEFROM - Edit the quarantine bcc from address.
- DMARCFROM - Edit the DMARC reports from address.
- OTHERFROM - Edit the all other messages from address.
[]> notifyfrom
Please enter the display name portion of the "notify from" address
["Mail Delivery System"]> Notifications
Please enter the user name portion of the "notify from" address
[MAILER-DAEMON]> Notification
Do you want the virtual gateway domain used for the domain? [Y]> n
Please enter the domain name portion of the "notify from" address
[]> example.com
Current anti-virus from: "Mail Delivery System" <MAILER-DAEMON@domain>
Current bounce from: "Mail Delivery System" <MAILER-DAEMON@domain>
Current notify from: Notifications <Notification@example.com>
Current quarantine from: "Mail Delivery System" <MAILER-DAEMON@domain>
Current DMARC reports from: "DMARC Feedback" <MAILER-DAEMON@domain>
Current all other messages from: "Mail Delivery System" <MAILER-DAEMON@domain>
Choose the operation you want to perform:
- AVFROM - Edit the anti-virus from address.
- BOUNCEFROM - Edit the bounce from address.
- NOTIFYFROM - Edit the notify from address.
- QUARANTINEFROM - Edit the quarantine bcc from address.
- DMARCFROM - Edit the DMARC reports from address.
- OTHERFROM - Edit the all other messages from address.
[]>

使用 adminaccessconfig 命令可以配置：

• 管理员的登录消息（欢迎信息）。
• 对设备管理界面的基于 IP 的访问。
• Web 界面跨站点请求伪造保护。
• 在 HTTP 请求中使用主机信头的选项。
• Web 界面和 CLI 会话不活动超时。
• HTTP 信头长度的最大值。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令支持批处理格式。

adminaccessconfig 命令的批处理格式可以用于执行传统 CLI 命令的所有功能。

• 选择是否允许访问所有 IP 地址或限制对特定 IP 地址/子网/范围的访问。

  adminaccessconfig ipaccess <all/restrict/proxyonly/proxy>

• 添加新的 IP 地址/子网/范围

  adminaccessconfig ipaccess new <address>

• 编辑现有 IP 地址/子网/范围

  adminaccessconfig ipaccess edit <oldaddress> <newaddress>

• 删除现有 IP 地址/子网/范围

  adminaccessconfig ipaccess delete <address>

• 打印 IP 地址/子网/范围的列表

  adminaccessconfig ipaccess print

• 删除所有现有 IP 地址/子网/范围

  adminaccessconfig ipaccess clear

• 打印登录标语

  adminaccessconfig banner print

• 从设备上的文件导入登录标语

  adminaccessconfig banner import <filename>

• 删除现有登录标语

  adminaccessconfig banner clear

• 打印欢迎信息

  adminaccessconfig welcome print

• 从设备上的文件导入欢迎标语

  adminaccessconfig welcome import <filename>

• 删除现有欢迎标语

  adminaccessconfig welcome clear

• 导出欢迎标语

  adminaccessconfig welcome export <filename>

• 添加允许的代理 IP 地址

  adminaccessconfig ipaccess proxylist new <address>

• 编辑允许的代理 IP 地址

  adminaccessconfig ipaccess proxylist edit <oldaddress> <newaddress>

• 删除允许的代理 IP 地址

  adminaccessconfig ipaccess proxylist delete <address>

• 删除所有现有允许的代理 IP 地址

  adminaccessconfig ipaccess proxylist clear

• 配置包含源 IP 地址的信头名称

  adminaccessconfig ipaccess proxy-header <header name>

• 启用或禁用 Web 界面跨站点请求伪造保护

  adminaccessconfig csrf <enable|disable>

• 检查 Web 界面跨站点请求伪造保护是否已启用

  adminaccessconfig csrf print

• 配置 Web 界面会话超时

  adminaccessconfig timeout gui <value>

• 配置 CLI 会话超时

  adminaccessconfig timeout gui <value>

您可以控制用户从哪些 IP 地址访问邮件安全设备。用户可以从任意具有您定义的访问列表中 IP 地址的计算机访问设备。当创建网络访问列表时，您可以指定 IP 地址、子网或 CIDR 地址。

如果在网络访问列表中未包括您当前计算机的 IP 地址，则 AsyncOS 会显示一个警告。如果当前计算机的 IP 地址不在列表中，则在您提交更改后将无法访问设备。

在下面的示例中，对设备的网络访问限定为两组 IP 地址：

mail.example.com> adminaccessconfig
Choose the operation you want to perform:
- BANNER - Configure login message (banner) for appliance administrator login.
- WELCOME - Configure welcome message (post login message) for appliance administrator login.
- IPACCESS - Configure IP-based access for appliance administrative interface.
- CSRF - Configure web UI Cross-Site Request Forgeries protection.
- HOSTHEADER - Configure option to use host header in HTTP requests.
- TIMEOUT - Configure GUI and CLI session inactivity timeout.
- MAXHTTPHEADERFIELDSIZE - Configure maximum HTTP header field size.
[]> ipaccess
Current mode: Allow All.
Please select the mode:
- ALL - All IP addresses will be allowed to access the administrative interface.
- RESTRICT - Specify IP addresses/Subnets/Ranges to be allowed access.
- PROXYONLY - Specify IP addresses/Subnets/Ranges to be allowed access through proxy.
- PROXY - Specify IP addresses/Subnets/Ranges to be allowed access through proxy or directly.
[]> restrict
List of allowed IP addresses/Subnets/Ranges:
Choose the operation you want to perform:
- NEW - Add a new IP address/subnet/range.
[]> new
Please enter IP address, subnet or range.
[]> 192.168.1.2-100
List of allowed IP addresses/Subnets/Ranges:
1.  192.168.1.2-100
Choose the operation you want to perform:
- NEW - Add a new IP address/subnet/range.
- EDIT - Modify an existing entry.
- DELETE - Remove an existing entry.
- CLEAR - Remove all the entries.
[]> new
Please enter IP address, subnet or range.
[]> 192.168.255.12
List of allowed IP addresses/Subnets/Ranges:
1.  192.168.1.2-100
2.  192.168.255.12
Choose the operation you want to perform:
- NEW - Add a new IP address/subnet/range.
- EDIT - Modify an existing entry.
- DELETE - Remove an existing entry.
- CLEAR - Remove all the entries.
[]>
Warning: The host you are currently using [72.163.202.175] is not included in the User Access list.  Excluding it will prevent your
host from connecting to the administrative interface. Are you sure you want to continue? [N]> Y
Current mode: Restrict.
Please select the mode:
- ALL - All IP addresses will be allowed to access the administrative interface.
- RESTRICT - Specify IP addresses/Subnets/Ranges to be allowed access.
- PROXYONLY - Specify IP addresses/Subnets/Ranges to be allowed access through proxy.
- PROXY - Specify IP addresses/Subnets/Ranges to be allowed access through proxy or directly.
[]>

当用户尝试通过 SSH、Telnet、FTP 或 Web UI 登录到设备时，您可以配置邮件安全设备以显示名为“登录标语”的消息。登录标语是可自定义文本，显示在 CLI 中的登录提示上方，以及 GUI 登录提示右侧。可以使用登录横幅显示设备的内部安全信息或最佳实践说明。例如，您可以创建一段简单说明，指出禁止未经授权使用该设备，或者有关组织有权审核用户对该设备所做更改的详细警告。

登录横幅的最大长度是 2000 个字符，以适合 80x25 的控制台。可从设备上 /data/pub/configuration 目录中的文件导入登录横幅。在创建横幅之后，请确认您的更改。

在下面的示例中，登录标语 “Use of this system in an unauthorized manner is prohibited” 会添加到设备：

mail.example.com> adminaccessconfig
Choose the operation you want to perform:
- BANNER - Configure login message (banner) for appliance administrator login.
- WELCOME - Configure welcome message (post login message) for appliance administrator login.
- IPACCESS - Configure IP-based access for appliance administrative interface.
- CSRF - Configure web UI Cross-Site Request Forgeries protection.
- HOSTHEADER - Configure option to use host header in HTTP requests.
- TIMEOUT - Configure GUI and CLI session inactivity timeout.
- MAXHTTPHEADERFIELDSIZE - Configure maximum HTTP header field size.
[]> banner
A banner has not been defined.
Choose the operation you want to perform:
- NEW - Create a banner to display at login.
- IMPORT - Import banner text from a file.
[]> new
Enter or paste the banner text here. Enter CTRL-D on a blank line to end.
Use of this system in an unauthorized manner is prohibited.
^D
Choose the operation you want to perform:
- BANNER - Configure login message (banner) for appliance administrator login.
- WELCOME - Configure welcome message (post login message) for appliance administrator login.
- IPACCESS - Configure IP-based access for appliance administrative interface.
- CSRF - Configure web UI Cross-Site Request Forgeries protection.
- HOSTHEADER - Configure option to use host header in HTTP requests.
- TIMEOUT - Configure GUI and CLI session inactivity timeout.
[]> banner
Banner: Use of this system in an unauthorized manner is prohibited.
Choose the operation you want to perform:
- NEW - Create a banner to display at login.
- IMPORT - Import banner text from a file.
- DELETE - Remove the banner.
[]>

以下示例会将 Web 界面和 CLI 会话的超时时间设置为 32 分钟。

注	CLI 会话超时仅适用于采用安全外壳 (SSH)、SCP 的连接以及直接串行连接。在 CLI 会话超时时的所有未提交的配置更改都将丢失。确保在进行配置更改后立即进行确认。

mail.example.com> adminaccessconfig
Choose the operation you want to perform:
- BANNER - Configure login message (banner) for appliance administrator login.
- WELCOME - Configure welcome message (post login message) for appliance administrator login.
- IPACCESS - Configure IP-based access for appliance administrative interface.
- CSRF - Configure web UI Cross-Site Request Forgeries protection.
- HOSTHEADER - Configure option to use host header in HTTP requests.
- TIMEOUT - Configure GUI and CLI session inactivity timeout.
- MAXHTTPHEADERFIELDSIZE - Configure maximum HTTP header field size.
[]> timeout
Enter WebUI inactivity timeout(in minutes):
[30]> 32
Enter CLI inactivity timeout(in minutes):
[30]> 32
Choose the operation you want to perform:
- BANNER - Configure login message (banner) for appliance administrator login.
- WELCOME - Configure welcome message (post login message) for appliance administrator login.
- IPACCESS - Configure IP-based access for appliance administrative interface.
- CSRF - Configure web UI Cross-Site Request Forgeries protection.
- HOSTHEADER - Configure option to use host header in HTTP requests.
- TIMEOUT - Configure GUI and CLI session inactivity timeout.
[]>
mail.example.com> commit
Please enter some comments describing your changes:
[]> Changed WebUI and CLI session timeout values
Do you want to save the current configuration for rollback? [Y]>
Changes committed: Wed Mar 12 08:03:21 2014 GMT

注	在提交更改之后，仅在后续登录期间新的 CLI 会话超时才会生效。

配置安全证书和密钥。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

在下面的示例中，通过在证书和私钥中粘贴可以安装证书。

mail3.example.com> certconfig
Choose the operation you want to perform:
- CERTIFICATE - Import, Create a request, Edit or Remove Certificate Profiles
- CERTAUTHORITY - Manage System and Customized Authorities
- CRL - Manage Certificate Revocation Lists
[]> certificate
List of Certificates
Name       Common Name           Issued By             Status         Remaining
---------  --------------------  --------------------  -------------  ---------
Demo       Cisco Appliance Demo  Cisco Appliance Demo  Active         3467 days
Choose the operation you want to perform:
- IMPORT - Import a certificate from a local PKCS#12 file
- PASTE - Paste a certificate into the CLI
- NEW - Create a self-signed certificate and CSR
- PRINT - View certificates assigned to services
[]> paste
Enter a name for this certificate profile:
> partner.com
Paste public certificate in PEM format (end with '.'):
-----BEGIN CERTIFICATE-----
MIICLDCCAdYCAQAwDQYJKoZIhvcNAQEEBQAwgaAxCzAJBgNVBAYTAlBUMRMwEQYD
VQQIEwpRdWVlbnNsYW5kMQ8wDQYDVQQHEwZMaXNib2ExFzAVBgNVBAoTDk5ldXJv
bmlvLCBMZGEuMRgwFgYDVQQLEw9EZXNlbnZvbHZpbWVudG8xGzAZBgNVBAMTEmJy
dXR1cy5uZXVyb25pby5wdDEbMBkGCSqGSIb3DQEJARYMc2FtcG9AaWtpLmZpMB4X
DTk2MDkwNTAzNDI0M1oXDTk2MTAwNTAzNDI0M1owgaAxCzAJBgNVBAYTAlBUMRMw
EQYDVQQIEwpRdWVlbnNsYW5kMQ8wDQYDVQQHEwZMaXNib2ExFzAVBgNVBAoTDk5l
dXJvbmlvLCBMZGEuMRgwFgYDVQQLEw9EZXNlbnZvbHZpbWVudG8xGzAZBgNVBAMT
EmJydXR1cy5uZXVyb25pby5wdDEbMBkGCSqGSIb3DQEJARYMc2FtcG9AaWtpLmZp
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAL7+aty3S1iBA/+yxjxv4q1MUTd1kjNw
L4lYKbpzzlmC5beaQXeQ2RmGMTXU+mDvuqItjVHOK3DvPK7lTcSGftUCAwEAATAN
BgkqhkiG9w0BAQQFAANBAFqPEKFjk6T6CKTHvaQeEAsX0/8YHPHqH/9AnhSjrwuX
9EBc0n6bVGhN7XaXd6sJ7dym9sbsWxb+pJdurnkxjx4=
-----END CERTIFICATE-----
.
C=PT,ST=Queensland,L=Lisboa,O=Neuronio,
Lda.,OU=Desenvolvimento,CN=brutus.partner.com,emailAddress=admin@example.com
Paste private key in PEM format (end with '.'):
-----BEGIN RSA PRIVATE KEY-----
MIIBPAIBAAJBAL7+aty3S1iBA/+yxjxv4q1MUTd1kjNwL4lYKbpzzlmC5beaQXeQ
2RmGMTXU+mDvuqItjVHOK3DvPK7lTcSGftUCAwEAAQJBALjkK+jc2+iihI98riEF
oudmkNziSRTYjnwjx8mCoAjPWviB3c742eO3FG4/soi1jD9A5alihEOXfUzloenr
8IECIQD3B5+0l+68BA/6d76iUNqAAV8djGTzvxnCxycnxPQydQIhAMXt4trUI3nc
a+U8YL2HPFA3gmhBsSICbq2OptOCnM7hAiEA6Xi3JIQECob8YwkRj29DU3/4WYD7
WLPgsQpwo1GuSpECICGsnWH5oaeD9t9jbFoSfhJvv0IZmxdcLpRcpslpeWBBAiEA
6/5B8J0GHdJq89FHwEG/H2eVVUYu5y/aD6sgcm+0Avg=
-----END RSA PRIVATE KEY-----
.
Do you want to add an intermediate certificate? [N]> n
List of Certificates
Name       Common Name           Issued By             Status         Remaining
--------  -------------------  --------------------  -------------  ---------
partner.c brutus.partner.com   brutus.partner       Active        30 days
Demo       Cisco Appliance Demo  Cisco Appliance Demo  Active         3467 days
Choose the operation you want to perform:
- IMPORT - Import a certificate from a local PKCS#12 file
- PASTE - Paste a certificate into the CLI
- NEW - Create a self-signed certificate and CSR
- EDIT - Update certificate or view the signing request
- EXPORT - Export a certificate
- DELETE - Remove a certificate
- PRINT - View certificates assigned to services
[]>
Choose the operation you want to perform:
- CERTIFICATE - Import, Create a request, Edit or Remove Certificate Profiles
- CERTAUTHORITY - Manage System and Customized Authorities
- CRL - Manage Certificate Revocation Lists
[]>
mail3.example.com> commit
Please enter some comments describing your changes:
[]> Installed certificate and key for receiving, delivery, and https
Do you want to save the current configuration for rollback? [Y]> n
Changes committed: Fri May 23 11:42:12 2014 GMT

在下面的示例中，会创建自签名证书。

mail3.example.com> certconfig
Choose the operation you want to perform:
- CERTIFICATE - Import, Create a request, Edit or Remove Certificate Profiles
- CERTAUTHORITY - Manage System and Customized Authorities
- CRL - Manage Certificate Revocation Lists
[]> certificate
List of Certificates
Name       Common Name           Issued By             Status         Remaining
---------  --------------------  --------------------  -------------  ---------
partner.c  brutus.neuronio.pt    brutus.neuronio.pt    Expired        -4930
days
Demo       Cisco Appliance Demo  Cisco Appliance Demo  Active         3467 days
Choose the operation you want to perform:
- IMPORT - Import a certificate from a local PKCS#12 file
- PASTE - Paste a certificate into the CLI
- NEW - Create a self-signed certificate and CSR
- EDIT - Update certificate or view the signing request
- EXPORT - Export a certificate
- DELETE - Remove a certificate
- PRINT - View certificates assigned to services
[]> new
1. Create a self-signed certificate and CSR
2. Create a self-signed SMIME certificate and CSR
[1]> 1
Enter a name for this certificate profile:
> example.com
Enter Common Name:
> example.com
Enter Organization:
> Example
Enter Organizational Unit:
> Org
Enter Locality or City:
> San Francisoc
Enter State or Province:
> CA
Enter Country (2 letter code):
> US
Duration before expiration (in days):
[3650]>
1. 1024
2. 2048
Enter size of private key:
[2]>
Do you want to view the CSR? [Y]> y
-----BEGIN CERTIFICATE REQUEST-----
MIICrTCCAZUCAQAwaDELMAkGA1UEBhMCVVMxFDASBgNVBAMTC2V4YW1wbGUuY29t
MRYwFAYDVQQHEw1TYW4gRnJhbmNpc29jMRAwDgYDVQQKEwdleGFtcGxlMQswCQYD
VQQIEwJDQTEMMAoGA1UECxMDb3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEA+NwamZyX7VgTZka/x1I5HHrN9V2MPKXoLq7FjzUtiIDwznElrKIuJovw
Svonle6GvFlUHfjv8B3WobOzk5Ny6btKjwPrBfaY+qr7rzM4lAQKHM+P6l+lZnPU
P05N9RCkLP4XsUuyY6Ca1WLTiPIgaq2fR8Y0JX/kesZcGOqlde66pN+xJIHHYadD
oopOgqi6SLNfAzJu/HEu/fnSujG4nhF0ZGlOpVUx4fg33NwZ4wVl0XBk3GrOjbbA
ih9ozAwfNzxb57amtxEJk+pW+co3uEHLJIOPdih9SHzn/UVU4hiu8rSQR19sDApp
kfdWcfaDLF9tnQJPWSYoCh0USgCc8QIDAQABoAAwDQYJKoZIhvcNAQEFBQADggEB
AGiVhyMAZuHSv9yA08kJCmrgO89yRlnDUXDDo6IrODVKx4hHTiOanOPu1nsThSvH
7xV4xR35T/QV0U3yPrL6bJbbwMySOLIRTjsUcwZNjOE1xMM5EkBM2BOI5rs4l59g
FhHVejhG1LyyUDL0U82wsSLMqLFH1IT63tzwVmRiIXmAu/lHYci3+vctb+sopnN1
lY1OIuj+EgqWNrRBNnKXLTdXkzhELOd8vZEqSAfBWyjZ2mECzC7SG3evqkw/OGLk
AilNXHayiGjeY+UfWzF/HBSekSJtQu6hIv6JpBSY/MnYU4tllExqD+GX3lru4xc4
zDas2rS/Pbpn73Lf503nmsw=
-----END CERTIFICATE REQUEST-----
List of Certificates
Name       Common Name           Issued By             Status         Remaining
---------  ------------------- --------------------  -------------  ---------
example.c  example.com           example.com           Valid          3649 days
partner.c  brutus.partner.com   brutus.partner.com  Valid         30 days
Demo       Cisco Appliance Demo  Cisco Appliance Demo  Active         3467 days
Choose the operation you want to perform:
- IMPORT - Import a certificate from a local PKCS#12 file
- PASTE - Paste a certificate into the CLI
- NEW - Create a self-signed certificate and CSR
- EDIT - Update certificate or view the signing request
- EXPORT - Export a certificate
- DELETE - Remove a certificate
- PRINT - View certificates assigned to services
[]>

以下示例展示如何创建自签名 S/MIME 证书以便为邮件签名。

vm10esa0031.qa> certconfig
Choose the operation you want to perform:
- CERTIFICATE - Import, Create a request, Edit or Remove Certificate Profiles
- CERTAUTHORITY - Manage System and Customized Authorities
- CRL - Manage Certificate Revocation Lists
[]> certificate
List of Certificates
Name       Common Name           Issued By             Status         Remaining
---------  --------------------  --------------------  -------------  ---------
Demo       Cisco Appliance Demo  Cisco Appliance Demo  Active         3329 days
Choose the operation you want to perform:
- IMPORT - Import a certificate from a local PKCS#12 file
- PASTE - Paste a certificate into the CLI
- NEW - Create a self-signed certificate and CSR
- PRINT - View certificates assigned to services
[]> new
1. Create a self-signed certificate and CSR
2. Create a self-signed SMIME certificate and CSR
[1]> 2
Enter a name for this certificate profile:
> smime_signing
Enter Common Name:
> CN
Enter Organization:
> ORG
Enter Organizational Unit:
> OU
Enter Locality or City:
> BN
Enter State or Province:
> KA
Enter Country (2 letter code):
> IN
Duration before expiration (in days):
[3650]>
1. 1024
2. 2048
Enter size of private key:
[2]>
Enter email address for 'subjectAltName' extension:
[]> admin@example.com
Add another member? [Y]> n
Begin entering domain entries for 'subjectAltName'.
Enter the DNS you want to add.
[]> domain.com
Add another member? [Y]> n
Do you want to view the CSR? [Y]> n
List of Certificates
Name       Common Name           Issued By             Status         Remaining
---------  --------------------  --------------------  -------------  ---------
smime_sig  CN                    CN                    Valid          3649 days
Demo       Cisco Appliance Demo  Cisco Appliance Demo  Active         3329 days
Choose the operation you want to perform:
- IMPORT - Import a certificate from a local PKCS#12 file
- PASTE - Paste a certificate into the CLI
- NEW - Create a self-signed certificate and CSR
- EDIT - Update certificate or view the signing request
- EXPORT - Export a certificate
- DELETE - Remove a certificate
- PRINT - View certificates assigned to services
[]>

显示当前日期和时间。

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

mail.example.com> date
Tue Mar 10 11:30:21 2015 GMT

使用 diagnostic 命令可以：

• 使用各种实用程序排除硬件和网络问题
• 检查 RAID 状态
• 显示 ARP 缓存
• 清除 LDAP、DNS 和 ARP 缓存
• 发送 SMTP 测试邮件

• 重启和查看设备上启用的服务引擎的状态。

以下命令在 diagnostic 子菜单内可用：

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。它被进一步限制为在登录主机（例如，您登录的特定计算机）上使用。此命令需要访问本地文件系统。

批处理命令：此命令支持批处理格式。

诊断命令的批处理量格式可用于检查 RAID 状态、清除缓存和显示 ARP 缓存中的内容。要作为批处理命令调用，请使用以下格式：

使用批处理格式执行以下操作：

• 检查 RAID 状态

  diagnostic raid

• 显示 ARP 缓存的内容

  diagnostic network arpshow

• 显示 NDP 缓存的内容

  diagnostic network ndpshow

• 清除 LDAP、DNS、ARP 和 NDP 缓存

  diagnostic network flush

• 重置并删除报告数据库

  diagnostic reporting deletedb

• 启用报告后台守护程序

  diagnostic reporting enable

• 禁用报告后台守护程序

  diagnostic reporting disable

• 重置并删除该跟踪数据库

  diagnostic tracking deletedb

• 重置对初始制造商值的配置

  diagnostic reload

可以使用 CLI 中的 diagnostic > services 子命令：

• 重启设备上启用的服务引擎，而不必重新启动设备。

• 查看设备上启用的服务引擎的状态。

示例：查看 DLP 引擎的状态

mail.example.com> diagnostic

Choose the operation you want to perform:
- RAID - Disk Verify Utility.
- DISK_USAGE - Check Disk Usage.
- NETWORK - Network Utilities.
- REPORTING - Reporting Utilities.
- TRACKING - Tracking Utilities.
- RELOAD - Reset configuration to the initial manufacturer values.
- SERVICES - Service Utilities.
[]> services

Choose one of the following services:
- ANTISPAM - Anti-Spam services
- ANTIVIRUS - Anti-Virus services
- DLP - Cisco Data Loss Prevention services
- ENCRYPTION - Encryption services
- GRAYMAIL - Graymail services
- REPORTING - Reporting associated services
- SBRS - Reputation Engine services
- TRACKING - Tracking associated services
- URLFILTERING - URL Filtering
- EUQWEB - End User Quarantine GUI
- WEBUI - Web GUI
[]> dlp

Choose the operation you want to perform:
- RESTART - Restart the service
- STATUS - View status of the service
[]> status

Cisco Data Loss Prevention has been up for 3s.

示例：重启 Graymail 引擎

mail.example.com> diagnostic

Choose the operation you want to perform:
- RAID - Disk Verify Utility.
- DISK_USAGE - Check Disk Usage.
- NETWORK - Network Utilities.
- REPORTING - Reporting Utilities.
- TRACKING - Tracking Utilities.
- RELOAD - Reset configuration to the initial manufacturer values.
- SERVICES - Service Utilities.
[]> services

Choose one of the following services:
- ANTISPAM - Anti-Spam services
- ANTIVIRUS - Anti-Virus services
- DLP - Cisco Data Loss Prevention services
- ENCRYPTION - Encryption services
- GRAYMAIL - Graymail services
- REPORTING - Reporting associated services
- SBRS - Reputation Engine services
- TRACKING - Tracking associated services
- URLFILTERING - URL Filtering
- EUQWEB - End User Quarantine GUI
- WEBUI - Web GUI
[]> graymail

Choose the operation you want to perform:
- RESTART - Restart the service
- STATUS - View status of the service
[]> restart

提交：此命令需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令支持批处理格式。

diskquotaconfig <feature> <quota> [<feature> <quota> [<feature> <quota>[<feature> <quota>]]]

<feature> 的有效值包括 euq、pvo、tracking、reporting

Valid values for <quota> are integers.

mail.example.com> diskquotaconfig
     Service                                       Disk Usage(GB)     Quota(GB)
     ---------------------------------------------------------------------------
     Spam Quarantine (EUQ)                         1                  1
     Policy, Virus & Outbreak Quarantines          1                  3
     Reporting                                     5                  10
     Tracking                                      1                  10
     Miscellaneous Files                           5                  30
           System Files Usage : 5 GB
           User Files Usage : 0 GB
     Total                                         13                 54 of 143
Choose the operation you want to perform:
- EDIT - Edit disk quotas
[]> edit
Enter the number of the service for which you would like to edit disk quota:
1. Spam Quarantine (EUQ)
2. Policy, Virus & Outbreak Quarantines
3. Reporting
4. Tracking
5. Miscellaneous Files
[1]> 1
Enter the new disk quota -
[1]> 1
Disk quota for Spam Quarantine (EUQ) changed to 1
     Service                                       Disk Usage(GB)     Quota(GB)
     ---------------------------------------------------------------------------
     Spam Quarantine (EUQ)                         1                  1
     Policy, Virus & Outbreak Quarantines          1                  3
     Reporting                                     5                  10
     Tracking                                      1                  10
     Miscellaneous Files                           5                  30
           System Files Usage : 5 GB
           User Files Usage : 0 GB
     Total                                         13                 54 of 143
Choose the operation you want to perform:
- EDIT - Edit disk quotas
[]>

提交：此命令需要“提交”。

群集管理：此命令可以用于群集中的所有级别。

批处理命令：此命令支持批处理格式。

• 指定非默认注册客户端服务器：

> ecconfig server <server_name:port>

使用默认注册客户端服务器：

> ecconfig server default 

mail.example.com> ecconfig
Enrollment Server: Not Configured (Use Default)
Choose the operation you want to perform:
- SETUP - Configure the Enrollment Server
[]> setup
Do you want to use non-default Enrollment server?
WARNING: Do not configure this option without the assistance of Cisco Support.
Incorrect configuration can impact the services using certificates from the Enrollment server. [N]> y
[]> 192.0.2.1
Choose the operation you want to perform:
- SETUP - Configure the Enrollment Server
[]>

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail.example.com> ecstatus
Component                 Version    Last Updated
Enrollment Client         1.0.2-046  Never updated

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令支持批处理格式。

> ecupdate [force]

mail.example.com> ecupdate
Requesting update of Enrollment Client. 

提交：此命令需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式

以下示例显示对加密配置文件的修改：

mail.example.com> encryptionconfig
IronPort Email Encryption: Enabled
Choose the operation you want to perform:
- SETUP - Enable/Disable IronPort Email Encryption
- PROFILES - Configure email encryption profiles
- PROVISION - Provision with the Cisco Registered Envelope Service
[]> setup
PXE Email Encryption: Enabled
Would you like to use PXE Email Encryption? [Y]>
WARNING: Increasing the default maximum message size(10MB) may result in
decreased performance. Please consult documentation for size recommendations
based on your environment.
Maximum message size for encryption: (Add a trailing K for kilobytes, M for
megabytes, or no letters for bytes.)
[10M]>
Enter the email address of the encryption account administrator
[administrator@example.com]>
IronPort Email Encryption: Enabled
Choose the operation you want to perform:
- SETUP - Enable/Disable IronPort Email Encryption
- PROFILES - Configure email encryption profiles
- PROVISION - Provision with the Cisco Registered Envelope Service
[]> profiles
Proxy: Not Configured
Profile Name         Key Service            Proxied     Provision Status
------------         -----------            -------     ----------------
HIPAA                Hosted Service         No          Not Provisioned
Choose the operation you want to perform:
- NEW - Create a new encryption profile
- EDIT - Edit an existing encryption profile
- DELETE - Delete an encryption profile
- PRINT - Print all configuration profiles
- CLEAR - Clear all configuration profiles
- PROXY - Configure a key server proxy
[]> edit
1. HIPAA
Select the profile you wish to edit:
[1]> 1
Profile name: HIPAA
External URL: https://res.cisco.com
Encryption algorithm: ARC4
Payload Transport URL: http://res.cisco.com
Envelope Security: High Security
Return receipts enabled: Yes
Secure Forward enabled: No
Secure Reply All enabled: No
Suppress Applet: No
URL associated with logo image: <undefined>
Encryption queue timeout: 14400
Failure notification subject: [ENCRYPTION FAILURE]
Failure notification template: System Generated
Filename for the envelope: securedoc_${date}T${time}.html
Use Localized Envelope: No
Text notification template: System Generated
HTML notification template: System Generated
Choose the operation you want to perform:
- NAME - Change profile name
- EXTERNAL - Change external URL
- ALGORITHM - Change encryption algorithm
- PAYLOAD - Change the payload transport URL
- SECURITY - Change envelope security
- RECEIPT - Change return receipt handling
- FORWARD - Change "Secure Forward" setting
- REPLYALL - Change "Secure Reply All" setting
- LOCALIZED_ENVELOPE - Enable or disable display of envelopes in languages
other than English
- APPLET - Change applet suppression setting
- URL - Change URL associated with logo image
- TIMEOUT - Change maximum time message waits in encryption queue
- BOUNCE_SUBJECT - Change failure notification subject
- FILENAME - Change the file name of the envelope attached to the encryption
notification.
[]> security
1. High Security (Recipient must enter a passphrase to open the encrypted
message, even if credentials are cached ("Remember Me" selected).)
2. Medium Security (No passphrase entry required if recipient credentials are
cached ("Remember Me" selected).)
3. No passphrase Required (The recipient does not need a passphrase to open the
encrypted message.)
Please enter the envelope security level:
[1]> 1
Profile name: HIPAA
External URL: https://res.cisco.com
Encryption algorithm: ARC4
Payload Transport URL: http://res.cisco.com
Envelope Security: High Security
Return receipts enabled: Yes
Secure Forward enabled: No
Secure Reply All enabled: No
Suppress Applet: No
URL associated with logo image: <undefined>
Encryption queue timeout: 14400
Failure notification subject: [ENCRYPTION FAILURE]
Failure notification template: System Generated
Filename for the envelope: securedoc_${date}T${time}.html
Use Localized Envelope: No
Text notification template: System Generated
HTML notification template: System Generated
Choose the operation you want to perform:
- NAME - Change profile name
- EXTERNAL - Change external URL
- ALGORITHM - Change encryption algorithm
- PAYLOAD - Change the payload transport URL
- SECURITY - Change envelope security
- RECEIPT - Change return receipt handling
- FORWARD - Change "Secure Forward" setting
- REPLYALL - Change "Secure Reply All" setting
- LOCALIZED_ENVELOPE - Enable or disable display of envelopes in languages
other than English
- APPLET - Change applet suppression setting
- URL - Change URL associated with logo image
- TIMEOUT - Change maximum time message waits in encryption queue
- BOUNCE_SUBJECT - Change failure notification subject
- FILENAME - Change the file name of the envelope attached to the encryption
notification.
[]> forward
Would you like to enable "Secure Forward"? [N]> y
Profile name: HIPAA
External URL: https://res.cisco.com
Encryption algorithm: ARC4
Payload Transport URL: http://res.cisco.com
Envelope Security: High Security
Return receipts enabled: Yes
Secure Forward enabled: Yes
Secure Reply All enabled: No
Suppress Applet: No
URL associated with logo image: <undefined>
Encryption queue timeout: 14400
Failure notification subject: [ENCRYPTION FAILURE]
Failure notification template: System Generated
Filename for the envelope: securedoc_${date}T${time}.html
Use Localized Envelope: No
Text notification template: System Generated
HTML notification template: System Generated
Choose the operation you want to perform:
- NAME - Change profile name
- EXTERNAL - Change external URL
- ALGORITHM - Change encryption algorithm
- PAYLOAD - Change the payload transport URL
- SECURITY - Change envelope security
- RECEIPT - Change return receipt handling
- FORWARD - Change "Secure Forward" setting
- REPLYALL - Change "Secure Reply All" setting
- LOCALIZED_ENVELOPE - Enable or disable display of envelopes in languages
other than English
- APPLET - Change applet suppression setting
- URL - Change URL associated with logo image
- TIMEOUT - Change maximum time message waits in encryption queue
- BOUNCE_SUBJECT - Change failure notification subject
- FILENAME - Change the file name of the envelope attached to the encryption
notification.
[]>
Proxy: Not Configured
Profile Name         Key Service            Proxied     Provision Status
------------         -----------            -------     ----------------
HIPAA                Hosted Service         No          Not Provisioned
Choose the operation you want to perform:
- NEW - Create a new encryption profile
- EDIT - Edit an existing encryption profile
- DELETE - Delete an encryption profile
- PRINT - Print all configuration profiles
- CLEAR - Clear all configuration profiles
- PROXY - Configure a key server proxy
[]>
IronPort Email Encryption: Enabled
Choose the operation you want to perform:
- SETUP - Enable/Disable IronPort Email Encryption
- PROFILES - Configure email encryption profiles
- PROVISION - Provision with the Cisco Registered Envelope Service
[]>

encryptionstatus 命令显示邮件安全设备上 PXE 引擎和域映射文件的版本，以及上次更新组件的日期和时间。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail3.example.com> encryptionstatus
Component                 Version    Last Updated
PXE Engine                6.7.1      17 Nov 2009 00:09 (GMT)
Domain Mappings File      1.0.0      Never updated

encryptionupdate 命令请求对邮件安全设备上的 PXE 引擎的更新。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。它被进一步限制为在登录主机（例如，您登录的特定计算机）上使用。

批处理命令：此命令不支持批处理格式。

mail3.example.com> encryptionupdate
Requesting update of PXE Engine.

Enginestatus 命令用于显示的状态和各种引擎在设备上启用的 CPU 使用情况。

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令支持批处理格式。有关详细信息，请键入命令 help enginestatus 来查阅联机帮助。

以下示例说明如何查看设备上启用的所有引擎的状态和 CPU 使用情况：

vm30esa0086.ibqa> enginestatus
Choose the operation you want to perform:
- GRAYMAIL - View Graymail engine status
- SOPHOS - View Sophos engine status
- CASE - View CASE engine status
- AMP - View AMP engine status
- MCAFEE - View McAfee engine status
- ALL - View status of All engines
[]> ALL
CASE Status: UP CPU: 0.0%
Component                      Version                             Last Updated
CASE Core Files                3.5.0-008                           Never updated
CASE Utilities                 3.5.0-008                           Never updated
Structural Rules               3.3.1-009-20141210_214201           Never updated
Web Reputation DB              20141211_111021                     Never updated
Web Reputation Rules           20141211_111021-20141211_170330     Never updated
Content Rules                  unavailable                         Never updated
Content Rules Update           unavailable                         Never updated
SOPHOS Status: UP CPU: 0.0%
Component                      Version                             Last Updated
Sophos Anti-Virus Engine       3.2.07.365.2_5.30                   Never updated
Sophos IDE Rules               0                                   Never updated
GRAYMAIL Status: UP CPU: 0.0%
Component                      Version                             Last Updated
Graymail Engine                01-392.68                           N10 Nov 2016 07:08 (GMT +00:00) updated
Graymail Rules                 01-392.68#121                       Never updated
Graymail Tools                 1.0.03                              Never updated
MCAFEE Status: UP CPU: 0.0%
Component                      Version                             Last Updated
McAfee Engine                  5700                                Never updated
McAfee DATs                    7437                                Never updated
AMP Status: UP CPU: 0.0%
Component                      Version                             Last Updated
AMP Client Settings            1.0                                 Never updated
AMP Client Engine              1.0                                 Never updated

featurekey 命令列出了系统上由密钥启用的所有功能以及与密钥相关的信息。它还允许您使用密钥激活功能或者检查新的功能密钥。

有关虚拟设备，另请参阅 loadlicense 和 showlicense。

提交：此命令需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式

在本示例中，featurekey 命令用于检查新的功能密钥。

mail3.example.com> featurekey
Module                              Quantity   Status     Remaining   Expiration Date
Outbreak Filters                    1          Active     28 days     Tue Feb 25 06:40:53 2014
IronPort Anti-Spam                  1          Dormant    30 days     Wed Feb 26 07:56:57 2014
Sophos Anti-Virus                   1          Active     26 days     Sun Feb 23 02:27:48 2014
Bounce Verification                 1          Dormant    30 days     Wed Feb 26 07:56:57 2014
Incoming Mail Handling              1          Active     20 days     Sun Feb 16 08:55:58 2014
IronPort Email Encryption           1          Dormant    30 days     Wed Feb 26 07:56:57 2014
Data Loss Prevention      	         1          Active     25 days     Fri Feb 21 10:07:10 2014
McAfee                              1          Dormant    30 days     Wed Feb 26 07:56:57 2014
Choose the operation you want to perform:
- ACTIVATE - Activate a (pending) key.
- CHECKNOW - Check now for new feature keys.
[]> checknow
No new feature keys are available.

借助 featurekeyconfig 命令，您可以配置计算机，以便自动下载可用密钥和更新计算机上的密钥。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机。

批处理命令：此命令不支持批处理格式。

在本示例中，featurekeyconfig 命令用于启用自动激活和自动检查功能。

mail3.example.com> featurekeyconfig
Automatic activation of downloaded keys: Disabled
Automatic periodic checking for new feature keys: Disabled
Choose the operation you want to perform:
- SETUP - Edit feature key configuration.
[]> setup
Automatic activation of downloaded keys: Disabled
Automatic periodic checking for new feature keys: Disabled
Choose the operation you want to perform:
- AUTOACTIVATE - Toggle automatic activation of downloaded keys.
- AUTOCHECK - Toggle automatic checking for new feature keys.
[]> autoactivate
Do you want to automatically apply downloaded feature keys? [N]> y
Automatic activation of downloaded keys: Enabled
Automatic periodic checking for new feature keys: Disabled
Choose the operation you want to perform:
- AUTOACTIVATE - Toggle automatic activation of downloaded keys.
- AUTOCHECK - Toggle automatic checking for new feature keys.
[]> autocheck
Do you want to periodically query for new feature keys? [N]> y
Automatic activation of downloaded keys: Enabled
Automatic periodic checking for new feature keys: Enabled

generalconfig 命令允许您配置浏览器设置。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令支持批处理格式。有关详细信息，请键入命令 help generalconfig 查阅联机帮助。

以下示例显示如何覆盖 IE 兼容模式：

mail.example.com> generalconfig
Choose the operation you want to perform:
- IEOVERRIDE - Configure Internet Explorer Compatibility Mode Override
[]> ieoverride
    For better web interface rendering, we recommend that you enable Internet
    Explorer Compatibility Mode Override. However, if enabling this feature
    is against your organizational policy, you may disable this feature.
    Internet Explorer Compatibility Mode Override is currently disabled.
Would you like to enable Internet Explorer Compatibility Mode Override? [N]y
Choose the operation you want to perform:
- IEOVERRIDE - Configure Internet Explorer Compatibility Mode Override
[]>

检查您的邮件安全设备的运行状况。运行状况检查分析当前状态日志中的历史数据（最多三个月），以确定设备的运行状况。

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

mail.example.com> healthcheck
Analyzing the system to determine current health of the system.
The analysis may take a while, depending on the size of the historical data.
System analysis is complete.
The analysis indicates that the system has experienced the following issue(s)recently:
Entered Resource conservation mode
Delay in mail processing
High CPU usage
High memory usage
Based on this analysis,
we recommend you to contact Cisco Customer Support before upgrading.

配置设备的各个运行状况参数的阈值，例如 CPU 使用情况、工作队列中的最大邮件数等

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

mail.example.com> healthconfig
Choose the operation you want to perform:
- WORKQUEUE - View and edit workqueue-health configuration.
- CPU - View and edit CPU-health configuration.
- SWAP - View and edit swap-health configuration.
[]> workqueue
Number of messages in the workqueue : 0
Current threshold on the workqueue size : 500
Alert when exceeds threshold : Disabled
Do you want to edit the settings? [N]> y
Please enter the threshold value for number of messages in work queue.
[500]> 550
Do you want to receive alerts if the number of messages in work queue exceeds
threshold value? [N]> n
Choose the operation you want to perform:
- WORKQUEUE - View and edit workqueue-health configuration.
- CPU - View and edit CPU-health configuration.
- SWAP - View and edit swap-health configuration.
[]> cpu
Overall CPU usage : 0 %
Current threshold on the overall CPU usage: 85 %
Alert when exceeds threshold : Disabled
Do you want to edit the settings? [N]> y
Please enter the threshold value for overall CPU usage (in percent)
[85]> 90
Do you want to receive alerts if the overall CPU usage exceeds threshold value?[N]> n
Choose the operation you want to perform:
- WORKQUEUE - View and edit workqueue-health configuration.
- CPU - View and edit CPU-health configuration.
- SWAP - View and edit swap-health configuration.
[]> swap
Number of pages swapped from memory in a minute : 0
Current threshold on the number of pages swapped from memory per minute : 5000
Alert when exceeds threshold : Disabled
Do you want to edit the settings? [N]> y
Please enter the threshold value for number of pages swapped from memory in a
minute.
[5000]> 5500
Do you want to receive alerts if number of pages swapped from memory in a
minute exceeds the threshold? [N]> n
Choose the operation you want to perform:
- WORKQUEUE - View and edit workqueue-health configuration.
- CPU - View and edit CPU-health configuration.
- SWAP - View and edit swap-health configuration.
[]>

ntpconfig 命令用于将 AsyncOS 配置为使用网络时间协议 (NTP)，以便将系统时钟与其他计算机同步。可以使用 settime 命令关闭 NTP。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

mail3.example.com> 
ntpconfig
Currently configured NTP servers:
1. time.ironport.com
Choose the operation you want to perform:
- NEW - Add a server.
- DELETE - Remove a server.
- SOURCEINT - Set the interface from whose IP address NTP queries should originate.
- AUTH - Configure NTP authentication.
[]> new
Please enter the fully qualified hostname or IP address of your NTP server.
[]> ntp.example.com
Currently configured NTP servers:
1. time.ironport.com
2. bitsy.mit.edi
Choose the operation you want to perform:
- NEW - Add a server.
- DELETE - Remove a server.
- SOURCEINT - Set the interface from whose IP address NTP queries should
originate.
- AUTH - Configure NTP authentication.
[]> sourceint
 
When initiating a connection to an NTP server, the outbound IP address 
used is chosen automatically.
If you want to choose a specific outbound IP address,please select 
its interface name now.
1. Auto
2. Management (172.19.0.11/24: elroy.run)
3. PrivateNet (172.19.1.11/24: elroy.run)
4. PublicNet (172.19.2.11/24: elroy.run)
[1]> 1
Currently configured NTP servers:
1. time.ironport.com
2. bitsy.mit.edi
Choose the operation you want to perform:
- NEW - Add a server.
- DELETE - Remove a server.
- SOURCEINT - Set the interface from whose IP address NTP queries should originate.
- AUTH - Configure NTP authentication.
[]> auth

Would you like to enable NTP authentication? [N]>yes
Currently configured NTP servers:
1. time.ironport.com
2. bitsy.mit.edi
Authentication is on
Choose the operation you want to perform:
- NEW - Add a server.
- DELETE - Remove a server.
- SOURCEINT - Set the interface from whose IP address NTP queries should
originate.
- AUTH - Configure NTP authentication.

mail3.example.com> commit
Please enter some comments describing your changes:
[]> Added new NTP server
Do you want to save the current configuration for rollback? [Y]> n
Changes committed: Fri May 23 11:42:12 2014 GMT

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

 
		mail3.example.com> portalregistrationconfig
	  
 Choose the operation you want to perform:
	 
 - REGISTRATION_ID - Set up the Registration ID.
	  []> registration_id 
	  Enter the new value of the Registration ID.
	  []> registrationidexample1234
	 

重新启动设备。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail3.example.com> reboot
Enter the number of seconds to wait before abruptly closing connections.
[30]>
Waiting for listeners to exit...
Receiving suspended.
Waiting for outgoing deliveries to finish...
Mail delivery suspended.

请求信誉引擎的版本信息。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail.example.com> repengstatus
  Component                   Last Update                     Version
  Reputation Engine           28 Jan 2014 23:47 (GMT +00:00)  1
  Reputation Engine Tools     28 Jan 2014 23:47 (GMT +00:00)  1

恢复接收和传送

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail3.example.com> resume
Receiving resumed for Listener 1.
Mail delivery resumed.
Mail delivery for individually suspended domains must be resumed individually.

恢复传输。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail.example.com> resumedel
Currently suspended domains:
1. domain1.com
2. domain2.com
3. domain3.com
Enter one or more domains [comma-separated] to which you want to resume delivery.
[ALL]> domain1.com, domain2.com
Mail delivery resumed.

恢复接收监听程序。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail3.example.com> resumelistener
Choose the listener(s) you wish to resume.
Separate multiple entries with commas.
1. All
2. InboundMail
3. OutboundMail
[1]> 1
Receiving resumed.
mail3.example.com>

恢复为先前的版本。

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

mail.example.com> revert
This command will revert the appliance to a previous version of AsyncOS.
WARNING: Reverting the appliance is extremely destructive.
The following data will be destroyed in the process:
- all configuration settings (including listeners)
- all log files
- all databases (including messages in Virus Outbreak and Policy quarantines)
- all reporting data (including saved scheduled reports)
- all message tracking data
- all IronPort Spam Quarantine message and end-user safelist/blocklist data
Only the network settings will be preserved.
Before running this command, be sure you have:
- saved the configuration file of this appliance (with passphrases unmasked)
- exported the IronPort Spam Quarantine safelist/blocklist database
  to another machine (if applicable)
- waited for the mail queue to empty
Reverting the device causes an immediate reboot to take place.
After rebooting, the appliance reinitializes itself and reboots
again to the desired version.
    Available versions
    =================
 1. 9.1.0-019
Please select an AsyncOS version [1]:
Do you want to continue? [N]> 

如果您未使用 NTP 服务器，则 settime 命令允许您手动设置时间。该命令会询问您是否要停止 NTP 和手动设置系统时钟。按如下格式输入时间：MM/DD/YYYY HH:MM:SS。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail3.example.com> settime
WARNING: Changes to system time will take place immediately
and do not require the user to run the commit command.
Current time 09/23/2001 21:03:53.
This machine is currently running NTP.
In order to manually set the time, NTP must be disabled.
Do you want to stop NTP and manually set the time? [N]> Y
Please enter the time in MM/DD/YYYY HH:MM:SS format.
[]> 09/23/2001 21:03:53
Time set to 09/23/2001 21:03:53.

设置本地时区。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

mail3.example.com> settz
Current time zone: Etc/GMT
Current time zone version: 2010.02.0
Choose the operation you want to perform:
- SETUP - Set the local time zone.
[]> setup
Please choose your continent:
1. Africa
2. America
[ ... ]
11. GMT Offset
[2]> 2
Please choose your country:
1. Anguilla
[ ... ]
45. United States
46. Uruguay
47. Venezuela
48. Virgin Islands (British)
49. Virgin Islands (U.S.)
[45]> 45
Please choose your timezone:
1. Alaska Time (Anchorage)
2. Alaska Time - Alaska panhandle (Juneau)
[ ... ]
21. Pacific Time (Los_Angeles)
[21]> 21
Current time zone: America/Los_Angeles
Choose the operation you want to perform:
- SETUP - Set the local time zone.
[]>

关闭要关闭电源的系统

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail.example.com> shutdown
Enter the number of seconds to wait before forcibly closing connections.
[30]> 
System shutting down.  Please wait while the queue is being closed...
Closing CLI connection.
The system will power off automatically.
Connection to mail.example.com closed.

smaconfig 命令用于添加、删除或查看 SMA 连接参数和密钥。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令支持批处理格式。

在下面的示例中，可以使用 smaconfig 命令通过预共享密钥将邮件安全设备添加到内容安全管理设备 (SMA)，并查看 SMA 连接详细信息（主机名和用户密钥）。

mail.example.com> smaconfig
Choose the operation you want to perform:
- ADD - Add a new SMA Connection Parameter and Key.
[]> add

Enter the hostname of the system that you want to add.
[]> m380q03.ibqa

Enter the user key of the host m380q03.ibqa.
Press enter on a blank line to finish.

SSH2:dsa
10.76.71.107 ssh-dss AAAAB3NzaC1kc3MAAACBAJCRYaVJgwSMTmLbt2xG5LVNKjFXpzW/vMRDQN3xclvJVpgYnQ1GfjL/zAbZC5pYz/jac405R9h+J2jTzAjzZRgaBIalVvi1Li0JkQQNhcRWEDjOhHwMTOkHh1+SVuqoR5xM0Y47jE/9SmEM6OXFSkAeTVXQq65c99FDGnNpvBWFAAAAFQD0dhuWPCD+++xjLZr4yxlWFJ5AdQAAAIBilaS+VDYY38IosX/9czWGIcBl7cqDZUXWkwoKF41OUfnoa42Q0VDBaoPiJ7gBhWVDHTo8rgz9PQRcl020Ok2ud7WASf/rLKbP9i26PWRK1yAAr7FvDol/l//5GtXbMtqWyVeo3oGqGS7dZc7MI/pMC5jGxDmTSM2SlyOEsS1xmQAAAIAY1ZiXC2ZeMhVWKgj8A8JHEPcgT4hu7Mo3Yq+YkGsemK4L+YF4k3t5DbGwirYvfXZCJSPD+E9mcnltIaOMFuB1W8Kiq+Cz/Ikzm9U4MdIz48HOKS2Sl7YVG3xhYJjyyRpLHGDYRagANtjvOLRPF57xUvkdz5DCcJiXbWEhaZBHkg==

SMA host key was added successfully.


Choose the operation you want to perform:
- ADD - Add a new SMA Connection Parameter and Key.
- DELETE - Remove an existing SMA Connection Parameter and Key.
- PRINT - Display all SMA Parameters and Keys.

[]> print
1. Hostname: m380q03.ibqa  Keys: SSH2:dsa10.76.71.107 ssh-dss
AAAAB3NzaC1kc3MAAACBAJCRYaVJgwSMTmLbt2xG5LVNKjFXpzW/vMRDQN3xclvJVpgYnQ1GfjL/zAbZC5pYz/jac405R9h+J2jTzAjzZRgaBIalVvi1Li0JkQQNhcRWEDjOhHwMTOkHh1+SVuqoR5xM0Y47jE/9SmEM6OXFSkAeTVXQq65c99FDGnNpvBWFAAAAFQD0dhuWPCD+++x
jLZr4yxlWFJ5AdQAAAIBilaS+VDYY38IosX/9czWGIcBl7cqDZUXWkwoKF41OUfnoa42Q0VDBaoPiJ7gBhWVDHTo8rgz9PQRcl020Ok2ud7WASf/rLKbP9i26PWRK1yAAr7FvDol/l//5GtXbMtqWyVeo3oGqGS7dZc7MI/pMC5jGxDmTSM2SlyOEsS1xmQAAAIAY1ZiXC2ZeMhVWKg
j8A8JHEPcgT4hu7Mo3Yq+YkGsemK4L+YF4k3t5DbGwirYvfXZCJSPD+E9mcnltIaOMFuB1W8Kiq+Cz/Ikzm9U4MdIz48HOKS2Sl7YVG3xhYJjyyRpLHGDYRagANtjvOLRPF57xUvkdz5DCcJiXbWEhaZBHkg==
Choose the operation you want to perform:
- ADD - Add a new SMA Connection Parameter and Key.
- DELETE - Remove an existing SMA Connection Parameter and Key.
- PRINT - Display all SMA Parameters and Keys.
[]> 

配置 SSH 服务器和用户密钥设置。

提交：此命令需要“提交”。

群集管理：此命令仅限在群集模式下使用。

批处理命令：此命令不支持批处理格式。

• 示例：编辑 SSH 服务器配置

• 示例：为管理员帐户安装新的公钥

• 示例：将 IP 地址归入永久黑名单或白名单

显示系统状态。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail3.example.com> status

Status as of:               Thu Oct 21 14:33:27 2004 PDT
Up since:                   Wed Oct 20 15:47:58 2004 PDT (22h 45m 29s)
Last counter reset:         Never
System status:              Online
Oldest Message:             4 weeks 46 mins 53 secs
Feature - McAfee:              161 days
[....]
Feature - Outbreak Filters:    161 days
Counters:                               Reset          Uptime        Lifetime
  Receiving
    Messages Received              62,049,822         290,920      62,049,822
    Recipients Received            62,049,823         290,920      62,049,823
  Rejection
    Rejected Recipients             3,949,663          11,921       3,949,663
    Dropped Messages               11,606,037             219      11,606,037
  Queue
    Soft Bounced Events             2,334,552          13,598       2,334,552
  Completion
    Completed Recipients           50,441,741         332,625      50,441,741
  Current IDs
    Message ID (MID)                                                 99524480
    Injection Conn. ID (ICID)                                        51180368
    Delivery Conn. ID (DCID)                                         17550674
Gauges:                               Current
  Connections
    Current Inbound Conn.                   0
    Current Outbound Conn.                 14
Queue
    Active Recipients                              1
    Messages In Work Queue                         0
    Kilobytes Used                                92
    Kilobytes Free                         8,388,516
  Quarantine
    Messages In Quarantine
      Policy, Virus and Outbreak                   0
    Kilobytes In Quarantine
      Policy, Virus and Outbreak                   0

向思科客户支持发送邮件。此命令要求设备可以向互联网发送邮件。故障通知单会自动创建，或者您可以将支持请求与现有故障通知单关联。

要直接从设备访问思科技术支持，您的 Cisco.com 用户 ID 必须与此设备的服务协议合同相关联。要查看当前与您的 Cisco.com 配置文件相关的服务合同列表，请访问位于 https://sso.cisco.com/autho/forms/CDClogin.html 的 Cisco.com 配置文件管理器。如果您没有 Cisco.com 用户 ID，则请注册一个。请参阅适用于您的版本的联机帮助或用户指南以了解注册帐户的信息。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。它被进一步限制为在登录主机（例如，您登录的特定计算机）上使用。此命令需要访问本地文件系统。

批处理命令：此命令不支持批处理格式。

以下示例显示与现有支持申请单不相关的支持请求。

mail.example.com> supportrequest
Please Note:
If you have an urgent issue, please call one of our worldwide Support Centers
(www.cisco.com/support). Use this command to open a technical support request
for issues that are not urgent, such as:
- Request for information.
- Problem for which you have a work-around, but would like an alternative
solution.
Do you want to send the support request to supportrequest@mail.qa? 
[Y]>
Do you want to send the support request to additional recipient(s)? 
[N]>
Is this support request associated with an existing support ticket? 
[N]>
Please select a technology related to this support request:
1. Security - Email and Web
2. Security - Management
[1]> 1
Please select a subtechnology related to this support request:
1. Cisco Email Security Appliance (C1x0,C3x0, C6x0, X10x0) - Misclassified
Messages
2. Cisco Email Security Appliance (C1x0,C3x0, C6x0, X10x0) - SBRS
3. Cisco Email Security Appliance (C1x0,C3x0, C6x0, X10x0) - Other
4. Email Security Appliance - Virtual
[1]> 3
Please select the problem category:
1. Upgrade
2. Operate
3. Configure
4. Install
[1]> 3
Please select a problem sub-category:
1. Error Messages, Logs, Debugs
2. Software Failure
3. Interoperability
4. Configuration Assistance
5. Install, Uninstall or Upgrade
6. Hardware Failure
7. Licensing
8. Data Corruption
9. Software Selection/Download Assistance
10. Passphrase Recovery
[1]> 5
Please enter a subject line for this support request:
[]> <Subject line for support request>
Please enter a description of your issue, providing as much detail as possible
to aid in diagnosis:
[]> <Description of issue>
It is important to associate all your service contracts with your Cisco.com profile (CCO ID) in order for you to receive complete 
access to support and services from Cisco. Please follow the URLs below to associate your contract coverage on your Cisco.com profile. 
If you do not have a CCO ID, please follow
the URL below to create a CCO ID.
How to create a CCO ID:
https://tools.cisco.com/RPF/register/register.do
How to associate your CCO ID with contract:
https://tools.cisco.com/RPFA/profile/profile_management.do
Frequently Asked Question:
http://www.cisco.com/web/ordering/cs_info/faqs/index.html
Select the CCOID
1. New CCOID
[1]>
Please enter the CCOID of the contact person :
[]> your name
The CCO ID may contain alphabets, numbers and '@', '.', '-' and '_' symbols.
Please enter the CCOID of the contact person :
[]> me@example.com
Please enter the name of the contact person :
[]> yourname
Please enter your email address:
[]> me@example.com
Please enter the contract ID:
[]> 1234
Please enter any additional contact information (e.g. phone number):
[]>
Please wait while configuration information is generated...
Do you want to print the support request to the screen? 
[N]>

显示从思科 TAC 请求支持的支持请求关键字版本信息。

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

mail.example.com> supportrequeststatus
Component                 Version    Last Updated
Support Request           1.0        Never updated

请求手动更新支持请求关键字，以便从思科 TAC 请求支持。

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

mail.example.com> supportrequestupdate
Requesting update of Support Request Keywords.

暂停接收和传送

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail3.example.com> suspend
Enter the number of seconds to wait before abruptly closing connections.
[30]> 45
Waiting for listeners to exit...
Receiving suspended for Listener 1.
Waiting for outgoing deliveries to finish...
Mail delivery suspended.
mail3.example.com>

暂停传送

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail.example.com> suspenddel
Enter the number of seconds to wait before abruptly closing connections.
[30]>
Enter one or more domains [comma-separated] to which you want to suspend delivery.
[ALL]> domain1.com, domain2.com, domain3.com
Waiting for outgoing deliveries to finish...
Mail delivery suspended.

暂停接收。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail3.example.com> suspendlistener
Choose the listener(s) you wish to suspend.
Separate multiple entries with commas.
1. All
2. InboundMail
3. OutboundMail
[1]> 1
Enter the number of seconds to wait before abruptly closing connections.
[30]>
Waiting for listeners to exit...
Receiving suspended.
mail3.example.com> 

显示流程打开的文件的相关信息。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail.cisco.com> tcpservices
System Processes (Note: All processes may not always be present)
  ftpd.main    - The FTP daemon
  ginetd       - The INET daemon
  interface    - The interface controller for inter-process communication
  ipfw         - The IP firewall
  slapd        - The Standalone LDAP daemon
  sntpd        - The SNTP daemon
  sshd         - The SSH daemon
  syslogd      - The system logging daemon
  winbindd     - The Samba Name Service Switch daemon
Feature Processes
  euq_webui    - GUI for ISQ
  gui          - GUI process
  hermes       - MGA mail server
  postgres     - Process for storing and querying quarantine data
  splunkd      - Processes for storing and querying Email Tracking data
COMMAND      USER         TYPE NODE   NAME
interface    root         IPv4 TCP    127.0.0.1:53
postgres     pgsql        IPv4 TCP    127.0.0.1:5432
qabackdoo    root         IPv4 TCP    *:8123
ftpd.main    root         IPv4 TCP    10.1.1.0:21
euq_webui    root         IPv4 TCP    10.1.1.0:83
euq_webui    root         IPv6 TCP    [2001:db8::]:83
gui          root         IPv4 TCP    172.29.181.70:80
gui          root         IPv4 TCP    10.1.1.0:80
gui          root         IPv6 TCP    [2001:db8::]:80
gui          root         IPv4 TCP    172.29.181.70:443
gui          root         IPv4 TCP    10.1.1.0:443
gui          root         IPv6 TCP    [2001:db8::]:443
ginetd       root         IPv4 TCP    172.29.181.70:22
ginetd       root         IPv4 TCP    10.1.1.0:22
ginetd       root         IPv6 TCP    [2001:db8::]:22
ginetd       root         IPv4 TCP    10.1.1.0:2222
ginetd       root         IPv6 TCP    [2001:db8::]:2222
hermes       root         IPv4 TCP    172.29.181.70:25
splunkd      root         IPv4 TCP    127.0.0.1:8089
splunkd      root         IPv4 TCP    127.0.0.1:9997
api_serve    root         IPv4 TCP    10.1.1.0:6080
api_serve    root         IPv6 TCP    [2001:db8::]:6080
api_serve    root         IPv4 TCP    10.1.1.0:6443
api_serve    root         IPv6 TCP    [2001:db8::]:6443
java         root         IPv6 TCP    [::127.0.0.1]:9999

允许思科 TAC 访问您的系统。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail3.example.com> techsupport
Service Access currently disabled.
Serial Number: XXXXXXXXXXXX-XXXXXXX
Choose the operation you want to perform:
- SSHACCESS - Allow a Cisco IronPort Customer Support representative to remotely access your system, without establishing a tunnel.
- TUNNEL - Allow a Cisco IronPort Customer Support representative to remotely access your system, and establish a secure tunnel 
           for communication.
- STATUS - Display the current techsupport status.
[]> sshaccess
A random seed string is required for this operation
1. Generate a random string to initialize secure communication (recommended)
2. Enter a random string
[1]> 1
Are you sure you want to enable service access? [N]> y
Service access has been ENABLED.  Please provide the string:
QT22-JQZF-YAQL-TL8L-8@2L-95
to your Cisco IronPort Customer Support representative.
Service Access currently ENABLED (0 current service logins).
Tunnel option is not active.
Serial Number: XXXXXXXXXXXX-XXXXXXX
Choose the operation you want to perform:
- DISABLE - Prevent customer service representatives from remotely accessing your system.
- STATUS - Display the current techsupport status.
[]>

按需建立出站 TLS 连接，并且调试与目的域相关的 TLS 连接问题。要创建连接，请指定要验证的域和目标主机。AsyncOS 会根据所需的（验证） TLS 设置检查 TLS 连接

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令支持批处理格式。

tlsverify 命令的批处理格式可以用于执行传统 CLI 命令的所有功能，可以检查与指定主机名的 TLS 连接。

tlsverify <domain> <hostname>[:<port>]

mail3.example.com> tlsverify
Enter the TLS domain to verify against:
[]> example.com
Enter the destination host to connect to.  Append the port (example.com:26) if you are not connecting on port 25:
[example.com]> mxe.example.com:25
Connecting to 1.1.1.1 on port 25.
Connected to 1.1.1.1 from interface 10.10.10.10.
Checking TLS connection.
TLS connection established: protocol TLSv1, cipher RC4-SHA.
Verifying peer certificate.
Verifying certificate common name mxe.example.com.
TLS certificate match mxe.example.com
TLS certificate verified.
TLS connection to 1.1.1.1 succeeded.
TLS successfully connected to mxe.example.com.
TLS verification completed.

通过系统跟踪邮件流

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail3.example.com> trace
Enter the source IP
[]> 192.168.1.1
Enter the fully qualified domain name of the source IP
[]> example.com
Select the listener to trace behavior on:
1. InboundMail
2. OutboundMail
[1]> 1
Fetching default SenderBase values...
Enter the SenderBase Org ID of the source IP.  The actual ID is N/A.
[N/A]>
Enter the SenderBase Reputation Score of the source IP.  The actual score is N/A.
[N/A]>
Enter the Envelope Sender address:
[]> pretend.sender@example.net
Enter the Envelope Recipient addresses.  Separate multiple addresses by commas.
[]> admin@example.com
Load message from disk?  [Y]> n
Enter or paste the message body here.  Enter '.' on a blank line to end.
Subject: Hello
This is a test message.
.
HAT matched on unnamed sender group, host ALL
 - Applying $ACCEPTED policy (ACCEPT behavior).
 - Maximum Message Size:  100M (Default)
 - Maximum Number Of Connections From A Single IP:  1000 (Default)
 - Maximum Number Of Messages Per Connection:  1,000 (Default)
 - Maximum Number Of Recipients Per Message:  1,000 (Default)
 - Maximum Recipients Per Hour:  100 (Default)
 - Use SenderBase For Flow Control:  Yes (Default)
 - Spam Detection Enabled:  Yes (Default)
 - Virus Detection Enabled:  Yes (Default)
 - Allow TLS Connections:  No (Default)
Processing MAIL FROM:
 - Default Domain Processing:  No Change
Processing Recipient List:
Processing admin@ironport.com
 - Default Domain Processing:  No Change
 - Domain Map:  No Change
 - RAT matched on admin@ironport.com, behavior = ACCEPT
 - Alias expansion:  No Change
Message Processing:
 - No Virtual Gateway(tm) Assigned
 - No Bounce Profile Assigned
Domain Masquerading/LDAP Processing:
 - No Changes.
Processing filter 'always_deliver':
Evaluating Rule:   rcpt-to == "@mail.qa"
    Result = False
Evaluating Rule:   rcpt-to == "ironport.com"
    Result = True
Evaluating Rule:   OR
    Result = True
Executing Action:  deliver()
Footer Stamping:
 - Not Performed
Inbound Recipient Policy Processing: (matched on Management Upgrade policy)
Message going to:  admin@ironport.com
AntiSpam Evaluation:
 - Not Spam
AntiVirus Evaluation:
 - Message Clean.
 - Elapsed Time = '0.000 sec'
Outbreak Filter Evaluation:
 - No threat detected
Message Enqueued for Delivery
Would you like to see the resulting message? [Y]> y
Final text for messages matched on policy Management Upgrade
Final Envelope Sender:  pretend.sender@example.doma
Final Recipients:
 - admin@ironport.com
Final Message Content:
Received: from remotehost.example.com (HELO TEST) (1.2.3.4)
  by stacy.qa with TEST; 19 Oct 2004 00:54:48 -0700
Message-Id: <3i93q9$@Management>
X-IronPort-AV: i="3.86,81,1096873200";
   d="scan'208"; a="0:sNHT0"
Subject: hello
This is a test message.
Run through another debug session? [N]>

注	使用跟踪时，必须同时包含粘贴到 CLI 中的消息的标题和正文。

配置跟踪系统。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

mail.example.com> trackingconfig
Message Tracking service status: Message Tracking is enabled.
Choose the operation you want to perform:
- SETUP - Enable Message Tracking for this appliance.
[]> setup
Would you like to use the Message Tracking Service? [Y]>
Do you want to use Centralized Message Tracking for this appliance? [N]>
Would you like to track rejected connections? [N]>
Message Tracking service status: Local Message Tracking is enabled.
Rejected connections are currently not being tracked.
Choose the operation you want to perform:
- SETUP - Enable Message Tracking for this appliance.
[]>

更新时区规则

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。它被进一步限制为在登录主机（例如，您登录的特定计算机）上使用。

批处理命令：此命令支持批处理格式。

即便没有检测到更改，tzupdate 命令的批处理格式也会强制更新所有时区规则。

tzupdate [force]

mail.example.com> tzupdate
Requesting update of Timezone Rules

配置系统更新参数。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

• 配置设备以便从更新服务器下载更新
• 配置设备以验证更新程序服务器器证书的有效性
• 配置设备以信任代理服务器通信

请求对所有系统服务组件进行更新。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。它被进一步限制为在登录主机（例如，您登录的特定计算机）上使用。

批处理命令：此命令支持批处理格式。

即便没有检测到更改，updatenow 命令的批处理格式可以用于更新设备上的所有组件。

updatenow [force]

mail3.example.com> updatenow
Success - All component updates requested

查看系统版本信息

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail3.example.com> version
Current Version
===============
Product: Cisco C100V Email Security Virtual Appliance
Model: C100V
Version: 9.1.0-019
Build Date: 2015-02-17
Install Date: 2015-02-19 05:17:56
Serial #: 421C73B18CFB05784A83-B03A99E71ED8
BIOS: 6.00
CPUs: 2 expected, 2 allocated
Memory: 6144 MB expected, 6144 MB allocated
RAID: NA
RAID Status: Unknown
RAID Type: NA
BMC: NA

使用 wipedata 命令可以清除磁盘上的核心文件，并检查最近一次核心转储操作的状态。

注	根据数据的规模，擦除操作可能需要一段时间，因此可能会影响系统性能，直到操作完成。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail.example.com> wipedata
Wiping data may take a while and can affect system performance till it completes.
Choose the operation you want to perform:
- STATUS - Display status of last command run
- COREDUMP - Wipe core files on disk
[]> coredump
wipedata: In progress
mail.example.com> wipedata
Wiping data may take a while and can affect system performance till it completes.
Choose the operation you want to perform:
- STATUS - Display status of last command run
- COREDUMP - Wipe core files on disk
[]> status
Last wipedata status: Successful

upgrade CLI 命令显示可用升级的列表，并且将 AsyncOS 系统升级到用户指定的版本。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail3.example.com> upgrade
Upgrades available:
1. AsyncOS (***DON'T TOUCH!***) 4.0.8 upgrade, 2005-05-09 Build 900
2. AsyncOS 4.0.8 upgrade, 2005-08-12 Build 030
.......
45. SenderBase Network Participation Patch
[45]>
Performing an upgrade will require a reboot of the system after the upgrade is applied.
 Do you wish to proceed with the upgrade? [Y]> Y

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail.example.com> contentscannerstatus
Component              Version                Last Updated
Content Scanner Tools  11.2.1884.970097       Never updated

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。它被进一步限制为在登录主机（例如，您登录的特定计算机）上使用。

批处理命令：此命令不支持批处理格式。

mail.example.com> contentscannerupdate force
Requesting forced update for Content Scanner.

配置 LDAP 服务器

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

在下面的示例中，ldapconfig 命令用于定义设备要绑定到的 LDAP 服务器，会配置以下查询：收件人接受情况（ldapaccept 子命令）、路由（ldaprouting 子命令）、伪装（masquerade 子命令）、垃圾邮件隔离区的最终用户身份验证（isqauth 子命令）、垃圾邮件通知的别名合并（isqalias 子命令）。

首先，将会为 mldapserver.example.com LDAP 服务器指定“PublicLDAP”别名。查询将定向到端口 3268（默认值）。会定义 example.com 的搜索库 (dc=example,dc=com)，同时还定义收件人接受情况、邮件重新路由和伪装。本示例中的查询与 OpenLDAP 目录配置类似，会使用已到期的 Internet Draft draft-lachman-laser-ldap-mail-routing-xx.txt 中定义的 inetLocalMailRecipient 附属对象类，有时也称为“Laser 规格”。（此草稿的 A 版本包含在 OpenLDAP 源分发中。）请注意，在本示例中，在邮件重新路由查询中用于已查询收件人的备用邮件主机为 mailForwardingAddress。确保查询名称区分大小写，必须完全一致才能返回正确的结果。

mail3.example.com> ldapconfig
No LDAP server configurations.
Choose the operation you want to perform:
- NEW - Create a new server configuration.
- SETUP - Configure LDAP options.
[]> new
Please create a name for this server configuration (Ex: "PublicLDAP"):
[]> PublicLDAP
Please enter the hostname:
[]> myldapserver.example.com
Use SSL to connect to the LDAP server? [N]> n
Select the authentication method to use for this server configuration:
1. Anonymous
2. Passphrase based
[1]> 2
Please enter the bind username:
[cn=Anonymous]>
Please enter the bind passphrase:
[]>
Connect to LDAP server to validate setting? [Y]
Connecting to the LDAP server, please wait...
Select the server type to use for this server configuration:
1. Active Directory
2. OpenLDAP
3. Unknown or Other
[3]> 1

Please enter the port number:
[3268]> 3268
Please enter the base:
[dc=example,dc=com]> dc=example,dc=com
Name: PublicLDAP
Hostname: myldapserver.example.com Port 3268
Server Type: Active Directory
Authentication Type: passphrase
Base: dc=example,dc=com
Choose the operation you want to perform:
- SERVER - Change the server for the query.
- TEST - Test the server configuration.
- LDAPACCEPT - Configure whether a recipient address should be accepted or
bounced/dropped.
- LDAPROUTING - Configure message routing.
- MASQUERADE - Configure domain masquerading.
- LDAPGROUP - Configure whether a sender or recipient is in a specified group.
- SMTPAUTH - Configure SMTP authentication.
- CERTAUTH - Configure certificate authentication.
- EXTERNALAUTH - Configure external authentication queries.
- ISQAUTH - Configure Spam Quarantine End-User Authentication Query.
- ISQALIAS - Configure Spam Quarantine Alias Consolidation Query.
[]> ldapaccept
Please create a name for this query:
[PublicLDAP.ldapaccept]> PublicLDAP.ldapaccept
Enter the LDAP query string:
[(proxyAddresses=smtp:{a})]> (proxyAddresses=smtp:{a})
Do you want to test this query? [Y]> n
Name: PublicLDAP
Hostname: myldapserver.example.com Port 3268
Server Type: Active Directory
Authentication Type: passphrase
Base: dc=example,dc=com
LDAPACCEPT: PublicLDAP.ldapaccept
Choose the operation you want to perform:
- SERVER - Change the server for the query.
- LDAPACCEPT - Configure whether a recipient address should be accepted or bounced/dropped.
- LDAPROUTING - Configure message routing.
- MASQUERADE - Configure domain masquerading.
- LDAPGROUP - Configure whether a sender or recipient is in a specified group.
- SMTPAUTH - Configure SMTP authentication.
- EXTERNALAUTH - Configure external authentication queries.
- ISQAUTH - Configure Spam Quarantine End-User Authentication Query.
- ISQALIAS - Configure Spam Quarantine Alias Consolidation Query.
[]> ldaprouting
Please create a name for this query:
[PublicLDAP.routing]> PublicLDAP.routing
Enter the LDAP query string:
[(mailLocalAddress={a})]> (mailLocalAddress={a})
The query requires one of the attributes below.  Please make a selection.
  [1] Configure MAILROUTINGADDRESS only - Rewrite the Envelope Recipient (and
leave MAILHOST unconfigured)?
  [2] Configure MAILHOST only - Send the messages to an alternate mail host
(and leave MAILROUTINGADDRESS unconfigured)?
  [3] Configure both attributes
[]> 1
Enter the attribute which contains the full rfc822 email address for the
recipients.
[mailRoutingAddress]> mailRoutingAddress
Do you want to test this query? [Y]> n
Name: PublicLDAP
Hostname: myldapserver.example.com Port 3268
Server Type: Active Directory
Authentication Type: passphrase
Base: dc=example,dc=com
LDAPACCEPT: PublicLDAP.ldapaccept
LDAPROUTING: PublicLDAP.routing
Choose the operation you want to perform:
- SERVER - Change the server for the query.
- LDAPACCEPT - Configure whether a recipient address should be accepted or bounced/dropped.
- LDAPROUTING - Configure message routing.
- MASQUERADE - Configure domain masquerading.
- LDAPGROUP - Configure whether a sender or recipient is in a specified group.
- SMTPAUTH - Configure SMTP authentication.
- EXTERNALAUTH - Configure external authentication queries.
- ISQAUTH - Configure Spam Quarantine End-User Authentication Query.
- ISQALIAS - Configure Spam Quarantine Alias Consolidation Query.
[]> masquerade
Please create a name for this query:
[PublicLDAP.masquerade]> PublicLDAP.masquerade
Enter the LDAP query string:
[(mailRoutingAddress={a})]> (mailRoutingAddress={a})
Enter the attribute which contains the externally visible full rfc822 email address.
[]> mailLocalAddress
Do you want the results of the returned attribute to replace the entire friendly portion of the original recipient? [N]> n
Do you want to test this query? [Y]> n
Name: PublicLDAP
Hostname: myldapserver.example.com Port 3268
Server Type: Active Directory
Authentication Type: passphrase
Base: dc=example,dc=com
LDAPACCEPT: PublicLDAP.ldapaccept
LDAPROUTING: PublicLDAP.routing
MASQUERADE: PublicLDAP.masquerade
Choose the operation you want to perform:
- SERVER - Change the server for the query.
- LDAPACCEPT - Configure whether a recipient address should be accepted or bounced/dropped.
- LDAPROUTING - Configure message routing.
- MASQUERADE - Configure domain masquerading.
- LDAPGROUP - Configure whether a sender or recipient is in a specified group.
- SMTPAUTH - Configure SMTP authentication.
- EXTERNALAUTH - Configure external authentication queries.
- ISQAUTH - Configure Spam Quarantine End-User Authentication Query.
- ISQALIAS - Configure Spam Quarantine Alias Consolidation Query.
[]> isqauth
Please create a name for this query:
[PublicLDAP.isqauth]> PublicLDAP.isqauth
Enter the LDAP query string:
[(sAMAccountName={u})]> (sAMAccountName={u})
Enter the list of email attributes.
[]> mail,proxyAddresses
Do you want to activate this query? [Y]> y
Do you want to test this query? [Y]> y
User identity to use in query:
[]> admin@example.com
Passphrase to use in query:
[]> passphrase
LDAP query test results:
LDAP Server: myldapserver.example.com
Query: PublicLDAP.isqauth
User: admin@example.com
Action: match positive
LDAP query test finished.
Name: PublicLDAP
Hostname: myldapserver.example.com Port 3268
Server Type: Active Directory
Authentication Type: passphrase
Base: dc=example,dc=com
LDAPACCEPT: PublicLDAP.ldapaccept
LDAPROUTING: PublicLDAP.routing
MASQUERADE: PublicLDAP.masquerade
ISQAUTH: PublicLDAP.isqauth [active]
Choose the operation you want to perform:
- SERVER - Change the server for the query.
- LDAPACCEPT - Configure whether a recipient address should be accepted or bounced/dropped.
- LDAPROUTING - Configure message routing.
- MASQUERADE - Configure domain masquerading.
- LDAPGROUP - Configure whether a sender or recipient is in a specified group.
- SMTPAUTH - Configure SMTP authentication.
- EXTERNALAUTH - Configure external authentication queries.
- ISQAUTH - Configure Spam Quarantine End-User Authentication Query.
- ISQALIAS - Configure Spam Quarantine Alias Consolidation Query.
[]>
Current LDAP server configurations:
1. PublicLDAP: (myldapserver.example.com:3268)
Choose the operation you want to perform:
- NEW - Create a new server configuration.
- SETUP - Configure LDAP options.
- EDIT - Modify a server configuration.
- DELETE - Remove a server configuration.
[]>

在下面的示例中，会配置 LDAP 全局设置，包括 TLS 连接的证书。

mail3.example.com> ldapconfig
No LDAP server configurations.
Choose the operation you want to perform:
- NEW - Create a new server configuration.
- SETUP - Configure LDAP options.
[]> setup
Choose the IP interface for LDAP traffic.
1. Auto
2. Management (10.92.145.175/24: esx16-esa01.qa)
[1]> 1
LDAP will determine the interface automatically.
Should group queries that fail to complete be silently treated as having
negative results? [Y]>
Validate LDAP server certificate? [Y]>
The "Demo" certificate is currently configured. You may use "Demo", but this will not be secure.
1. partner.com
2. Demo
Please choose the certificate to apply:
[1]> 1
No LDAP server configurations.
Choose the operation you want to perform:
- NEW - Create a new server configuration.
- SETUP - Configure LDAP options.
[]>

清理所有缓存的 LDAP 结果。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式

mail3.example.com> ldapflush
Are you sure you want to flush any cached LDAP results? [N]> y
Flushing cache
mail3.example.com>

执行单个 LDAP 查询测试

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式

在本示例中，该 ldaptest 命令用于为配置的 LDAP 服务器配置测试唯一的收件人接受查询。收件人地址“admin@example.com”会通过测试，而收件人地址“bogus@example.com”则未通过测试。

mail3.example.com> ldaptest
Select which LDAP query to test:
1. PublicLDAP.ldapaccep
[1]> 1
Address to use in query:
[]> admin@example.com
LDAP query test results:
                Query: PublicLDAP.ldapaccept
             Argument: admin@example.com
               Action: pass
LDAP query test finished.
mail3.example.com> ldaptest
Select which LDAP query to test:
1. PublicLDAP.ldapaccep
[1]> 1
Address to use in query:
[]> bogus@example.com
LDAP query test results:
 Query: PublicLDAP.ldapaccept
 Argument: bogus@example.com
 Action: drop or bounce (depending on listener settings)
 Reason: no matching LDAP record was found
LDAP query test finished.
mail3.example.com>

设置或禁用用于 Sieve 邮件过滤的字符，如 RFC 3598 中所述。请注意，Sieve 字符仅在 LDAP 接受和 LDAP 重新路由查询中会被识别。系统的其他部分将在完整的邮件地址中操作。

允许的字符为：-_=+/^#

提交：此命令不需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式

在本示例中，sievechar 命令用于将 + 定义为在接受和 LDAP 重新路由查询中可被识别的 Sieve 字符。

mail3.example.com> sievechar
Sieve Email Filtering is currently disabled.
Choose the operation you want to perform:
- SETUP - Set the separator character.
[]> setup
Enter the Sieve Filter Character, or a space to disable Sieve Filtering.
[]> +
Sieve Email Filter is enabled, using the '+' character as separator.
This applies only to LDAP Accept and LDAP Reroute Queries.
Choose the operation you want to perform:
- SETUP - Set the separator character.
[]> 

配置地址列表。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令支持批处理格式。

addresslistconfig 命令的批处理格式可以用于创建新的地址列表、编辑现有地址列表、打印地址列表的列表、删除地址列表或者查找地址列表中的冲突地址。

• 添加新的地址列表：

  
  addresslistconfig new <name> --descr=<description> --addresses=<address1,address2,...>

• 编辑现有地址列表：

  
  addresslistconfig edit <name> --name=<new-name> --descr=<description> --addresses=<address1,address2,...>

• 删除地址列表：

  
  addresslistconfig delete <name>

• 打印地址列表的列表：

  
  addresslistconfig print <name>

• 查找地址列表中的冲突地址：

  
  addresslistconfig conflicts <name>

mail.example.com> addresslistconfig
No address lists configured.
Choose the operation you want to perform:
- NEW - Create a new address list.
[]> new
Enter a name for the address list:
> add-list1
Enter a description for the address list:
> This is a sample address list.
Do you want to enter only full Email Addresses? [N]> Y
Enter a comma separated list of addresses:
(e.g.: user@example.com)
> user1@example.com, user2@example.com
Address list "add-list1" added.
Choose the operation you want to perform:
- NEW - Create a new address list.
- EDIT - Modify an address list.
- DELETE - Remove an address list.
- PRINT - Display the contents of an address list.
- CONFLICTS - Find conflicting entries within an address list.
[]>

配置邮件别名。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令支持批处理格式。

aliasconfig 命令的批处理格式可以用于添加新的别名表、编辑现有表、打印邮件别名的列表以及导入/导出别名表。要调用为批处理命令，请将以下格式的 aliasconfig 命令与下面列出的变量结合使用：

• 添加新的邮件别名：

  aliasconfig new <domain> <alias> [email_address1] [email_address2] ...

注	使用带非现存域的 ‘aliasconfig new’ 命令会导致创建域。

• 编辑现有邮件别名

  aliasconfig edit <domain> <alias> <email_address1] [email_address2] ...

• 显示邮件别名：

  aliasconfig print

• 导入本地别名列表：

  aliasconfig import <filename>

• 导出设备上的别名列表：

  aliasconfig export <filename>

mail3.example.com> aliasconfig
Enter address(es) for "customercare".
Separate multiple addresses with commas.
[]> bob@example.com, frank@example.com, sally@example.com
Adding alias customercare: bob@example.com,frank@example.com,sally@example.com
Do you want to add another alias?  [N]> n
There are currently 1 mappings defined.
Choose the operation you want to perform:
- NEW - Create a new entry.
- EDIT - Modify an entry.
- DELETE - Remove an entry.
- PRINT - Display the table.
- IMPORT - Import aliases from a file.
- EXPORT - Export table to a file.
- CLEAR - Clear the table.
[]> new
How do you want your aliases to apply?
1. Globally
2. Add a new domain context
3. example.com
[1]> 1
Enter the alias(es) to match on.
Separate multiple aliases with commas.
Allowed aliases:
    - "user@domain" - This email address.
    - "user" - This user for any domain
    - "@domain" - All users in this domain.
    - "@.partialdomain" - All users in this domain, or any of its sub domains.
[]> admin
Enter address(es) for "admin".
Separate multiple addresses with commas.
[]> administrator@example.com
Adding alias admin: administrator@example.com
Do you want to add another alias?  [N]> n
There are currently 2 mappings defined.
Choose the operation you want to perform:
- NEW - Create a new entry.
- EDIT - Modify an entry.
- DELETE - Remove an entry.
- PRINT - Display the table.
- IMPORT - Import aliases from a file.
- EXPORT - Export table to a file.
- CLEAR - Clear the table.
[]> print
admin: administrator@example.com
[ example.com ]
customercare: bob@example.com, frank@example.com, sally@example.com
There are currently 2 mappings defined.
Choose the operation you want to perform:
- NEW - Create a new entry.
- EDIT - Modify an entry.
- DELETE - Remove an entry.
- PRINT - Display the table.
- IMPORT - Import aliases from a file.
- EXPORT - Export table to a file.
- CLEAR - Clear the table.
[]>

在您的队列中存档旧邮件。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

在下面的示例中，会存档一封较早的邮件：

mail3.example.com> 
archivemessage
Enter the MID to archive.
[0]> 47

MID 47 has been saved in file oldmessage_47.mbox in the configuration

配置虚拟网关 (tm) 映射。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

在下面的示例中，将打印 altsrchost 表以显示不存在映射。然后，创建两个条目：

• 来自名为 @exchange.example.com 组件服务器主机的邮件将映射到 PublicNet 接口。
• 来自发件人 IP 地址 192.168.35.35 的邮件会映射到 AnotherPublicNet 接口。

最后，将 altsrchost 映射打印出来，以确认并提交更改。

mail3.example.com> altsrchost
There are currently no mappings configured.
Choose the operation you want to perform:
- NEW - Create a new mapping.
- IMPORT - Load new mappings from a file.
[]> new
Enter the Envelope From address or client IP address for which you want to set up a Virtual Gateway mapping.  
Partial addresses such as "@example.com" or "user@" are allowed.
[]> @exchange.example.com
Which interface do you want to send messages for @exchange.example.com from?
1. AnotherPublicNet (192.168.2.2/24: mail4.example.com)
2. Management (192.168.42.42/24: mail3.example.com)
3. PrivateNet (192.168.1.1/24: mail3.example.com)
4. PublicNet (192.168.2.1/24: mail4.example.com)
[1]> 4
Mapping for @exchange.example.com on interface PublicNet created.
Choose the operation you want to perform:
- NEW - Create a new mapping.
- EDIT - Modify a mapping.
- DELETE - Remove a mapping.
- IMPORT - Load new mappings from a file.
- EXPORT - Export all mappings to a file.
- PRINT - Display all mappings.
- CLEAR - Remove all mappings.
[]> new
Enter the Envelope From address or client IP address for which you want to set up a Virtual Gateway mapping.  
Partial addresses such as "@example.com" or "user@" are allowed.
[]> 192.168.35.35
Which interface do you want to send messages for 192.168.35.35 from?
1. AnotherPublicNet (192.168.2.2/24: mail4.example.com)
2. Management (192.168.42.42/24: mail3.example.com)
3. PrivateNet (192.168.1.1/24: mail3.example.com)
4. PublicNet (192.168.2.1/24: mail4.example.com)
[1]> 1
Mapping for 192.168.35.35 on interface AnotherPublicNet created.
Choose the operation you want to perform:
- NEW - Create a new mapping.
- EDIT - Modify a mapping.
- DELETE - Remove a mapping.
- IMPORT - Load new mappings from a file.
- EXPORT - Export all mappings to a file.
- PRINT - Display all mappings.
- CLEAR - Remove all mappings.
[]> print
1. 192.168.35.35 -> AnotherPublicNet
2. @exchange.example.com -> PublicNet
Choose the operation you want to perform:
- NEW - Create a new mapping.
- EDIT - Modify a mapping.
- DELETE - Remove a mapping.
- IMPORT - Load new mappings from a file.
- EXPORT - Export all mappings to a file.
- PRINT - Display all mappings.
- CLEAR - Remove all mappings.
[]>
mail3.example.com> commit
Please enter some comments describing your changes:
[]> Added 2 altsrchost mappings 
Do you want to save the current configuration for rollback? [Y]> n
Changes committed: Fri May 23 11:42:12 2014 GMT

Configure the behavior of bounces.

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令支持批处理格式。请查阅联机 CLI 帮助了解更多详细信息。使用 help 命令可以访问此命令的联机帮助。

在下面的示例中，会使用 bounceconfig 命令创建名为 bounceprofile 的退回配置文件。在此配置文件，所有硬退回邮件均发送到备用地址 bounce-mailbox@example.com。已启用延迟警告邮件。将向每个收件人发送一封警告邮件，并且接受了警告邮件之间 4 小时（14400 秒）的默认值。

mail3.example.com> bounceconfig
Current bounce profiles:
1. Default
Choose the operation you want to perform:
- NEW - Create a new profile.
- EDIT - Modify a profile.
[]> new
Please create a name for the profile:
[]> bounceprofile
Please enter the maximum number of retries.
[100]> 100
Please enter the maximum number of seconds a message may stay in the queue before being hard bounced.
[259200]> 259200
Please enter the initial number of seconds to wait before retrying a message.
[60]> 60
Please enter the maximum number of seconds to wait before retrying a message.
[3600]> 3600
Do you want a message sent for each hard bounce? (Yes/No/Default) [Y]> y
Do you want bounce messages to use the DSN message format? (Yes/No/Default) [Y]> y
Enter the subject to use:
[Delivery Status Notification (Failure)]> 
Select default notification template:
1. System Generated
2. bounce_english
3. bounce_russian
[1]> 
Do you want to configure language specific templates? [N]> 
Do you want to parse the DSN "Status" field received from bounce
responses to include in the DSN generated by the appliance?
(Yes/No/Default) [N]> 
If a message is undeliverable after some interval, do you want to send a delay warning message? (Yes/No/Default) [N]> y
Enter the subject to use:
[Delivery Status Notification (Delay)]> 
Select default notification template:
1. System Generated
2. bounce_english
3. bounce_russian
[1]> 1
Do you want to configure language specific templates? [N]> 
Please enter the minimum interval in seconds between delay warning messages.
[14400]> 14400
Please enter the maximum number of delay warning messages to send per
recipient.
[1]> 1
Do you want hard bounce and delay warning messages sent to an alternate address, instead of the sender? [N]> y
Please enter the email address to send hard bounce and delay warning.
[]> bounce-mailbox@example.com
Do you want bounce messages to be signed (Yes/No/Default)?  [N]> 
Current bounce profiles:
1. Default
2. bounceprofile
Choose the operation you want to perform:
- NEW - Create a new profile.
- EDIT - Modify a profile.
- DELETE - Remove a profile.
[]>
mail3.example.com>

在配置完退回配置文件后，您可以使用 listenerconfig -> bounceconfig 命令并提交更改来为每个监听程序应用配置文件。

注	可以基于接收邮件所在的监听程序来应用退回配置文件。但是，此监听程序与该邮件的最终传输方式没有关系。

在本示例中，会编辑 OutboundMail 专用监听程序，并且名为 bouncepr1 的退回配置文件会应用于该监听程序。

mail3.example.com> listenerconfig
Currently configured listeners:
1. InboundMail (on PublicNet, 192.168.2.1) SMTP Port 25 Public
2. OutboundMail (on PrivateNet, 192.168.1.1) SMTP Port 25 Private
Choose the operation you want to perform:
- NEW - Create a new listener.
- EDIT - Modify a listener.
- DELETE - Remove a listener.
- SETUP - Change global settings.
[]> edit
Enter the name or number of the listener you wish to edit.
[]> 2
Name: OutboundMail
Type: Private
Interface: PrivateNet (192.168.1.1/24) TCP Port 25
Protocol: SMTP
Default Domain:
Max Concurrency: 600 (TCP Queue: 50)
Domain Map: Disabled
TLS: No
SMTP Authentication: Disabled
Bounce Profile: Default
Footer: None
LDAP: Off
Choose the operation you want to perform:
- NAME - Change the name of the listener.
- INTERFACE - Change the interface.
- LIMITS - Change the injection limits.
- SETUP - Configure general options.
- HOSTACCESS - Modify the Host Access Table.
- BOUNCECONFIG - Choose the bounce profile to use for messages injected on this listener.
- MASQUERADE - Configure the Domain Masquerading Table.
- DOMAINMAP - Configure domain mappings.
[]> bounceconfig
Please choose a bounce profile to apply:
1. Default
2. bouncepr1
3. New Profile
[1]> 2
Name: OutboundMail
Type: Private
Interface: PrivateNet (192.168.1.1/24) TCP Port 25
Protocol: SMTP
Default Domain:
Max Concurrency: 600 (TCP Queue: 50)
Domain Map: Disabled
TLS: No
SMTP Authentication: Disabled
Bounce Profile: bouncepr1
Footer: None
LDAP: Off
Choose the operation you want to perform:
- NAME - Change the name of the listener.
- INTERFACE - Change the interface.
- LIMITS - Change the injection limits.
- SETUP - Configure general options.
- HOSTACCESS - Modify the Host Access Table.
- BOUNCECONFIG - Choose the bounce profile to use for messages injected on this listener.
- MASQUERADE - Configure the Domain Masquerading Table.
- DOMAINMAP - Configure domain mappings.
[]>
Currently configured listeners:
1. InboundMail (on PublicNet, 192.168.2.1) SMTP Port 25 Public
2. OutboundMail (on PrivateNet, 192.168.1.1) SMTP Port 25 Private
Choose the operation you want to perform:
- NEW - Create a new listener.
- EDIT - Modify a listener.
- DELETE - Remove a listener.
- SETUP - Change global settings.
[]>
mail3.example.com> commit
Please enter some comments describing your changes:
[]> Enabled the bouncepr1 profile to the Outbound mail listener
Do you want to save the current configuration for rollback? [Y]> n
Changes committed: Fri May 23 11:42:12 2014 GMT

从队列退回邮件。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式

目标收件人主机或邮件信封的信封发件人行所示的特定地址识别的邮件发件人可对要退回的收件人进行识别。另外，可以一次性退回传送队列中的所有邮件。

配置退回验证的设置。使用此命令可以配置密钥和无效的退回邮件。

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

下面的示例显示为无效退回邮件配置的关键配置和设置。

mail3.example.com> bvconfig
Behavior on invalid bounces: reject
Key for tagging outgoing mail: key
Previously-used keys for verifying incoming mail:
        1. key (current outgoing key)
        2. goodneighbor (last in use Wed May 31 23:21:01 2006 GMT)
Choose the operation you want to perform:
- KEY - Assign a new key for tagging outgoing mail.
- PURGE - Purge keys no longer needed for verifying incoming mail.
- CLEAR - Clear all keys including current key.
- SETUP - Set how invalid bounces will be handled.
[]> key
Enter the key to tag outgoing mail with (when tagging is enabled in the Good
Neighbor Table)
[]> basic_key
Behavior on invalid bounces: reject
Key for tagging outgoing mail: basic_key
Previously-used keys for verifying incoming mail:
        1. basic_key (current outgoing key)
        2. key (last in use Wed May 31 23:22:49 2006 GMT)
        3. goodneighbor (last in use Wed May 31 23:21:01 2006 GMT)
Choose the operation you want to perform:
- KEY - Assign a new key for tagging outgoing mail.
- PURGE - Purge keys no longer needed for verifying incoming mail.
- CLEAR - Clear all keys including current key.
- SETUP - Set how invalid bounces will be handled.
[]> setup
How do you want bounce messages which are not addressed to a valid tagged
recipient to be handled?
1. Reject.
2. Add a custom header and deliver.
[1]> 1
Behavior on invalid bounces: reject
Key for tagging outgoing mail: basic_key
Previously-used keys for verifying incoming mail:
        1. basic_key (current outgoing key)
        2. key (last in use Wed May 31 23:22:49 2006 GMT)
        3. goodneighbor (last in use Wed May 31 23:21:01 2006 GMT)
Choose the operation you want to perform:
- KEY - Assign a new key for tagging outgoing mail.
- PURGE - Purge keys no longer needed for verifying incoming mail.
- CLEAR - Clear all keys including current key.
- SETUP - Set how invalid bounces will be handled.
[]>
mail3.example.com> commit
Please enter some comments describing your changes:
[]> Configuring a new key and setting reject for invalid email bounces
Do you want to save the current configuration for rollback? [Y]> n
Changes committed: Fri May 23 11:42:12 2014 GMT

从队列中删除邮件

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式

设备为您提供了根据需要删除收件人的选项。以下示例显示了如何按收件人主机删除收件人、按信封发件人地址进行删除以及删除队列中的所有收件人。

mail3.example.com> deleterecipients
Please select how you would like to delete messages:
1. By recipient host.
2. By Envelope From address.
3. All.
[1]> 1
Are you sure you want to delete all messages in the queue? [N]> Y
Deleting messages, please wait.
1000 messages deleted.

配置邮件传送

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式。

在以下示例中，deliveryconfig 命令用于将默认接口设置为“自动”(Auto) 并启用“可能的传送”(Possible Delivery)。系统级的最大出站邮件传送连接数设置为 9000 个。

mail3.example.com> deliveryconfig
Choose the operation you want to perform:
- SETUP - Configure mail delivery.
[]> setup
Choose the default interface to deliver mail.
1. Auto
2. AnotherPublicNet (192.168.3.1/24: mail4.example.com)
3. Management (192.168.42.42/24: mail3.example.com)
4. PrivateNet (192.168.1.1/24: mail3.example.com)
5. PublicNet (192.168.2.1/24: mail3.example.com)
[1]> 1
Enable "Possible Delivery" (recommended)?  [Y]> y
Please enter the default system wide maximum outbound message delivery
concurrency
[10000]> 9000
mail3.example.com>

重新安排邮件以立即进行传输。用户可以选择单个收件人主机或是当前计划要传输的所有邮件。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式

mail3.example.com> delivernow
Please choose an option for scheduling immediate delivery.
1. By recipient domain
2. All messages
[1]> 1
Please enter the recipient domain to schedule for delivery.
[]>foo.com
Scheduling all messages to foo.com for delivery.

以下命令在 destconfig 子菜单内可用：

destconfig 命令要求为目标控制表中的每行提供以下信息。

• 域（收件人主机）
• 与域的最大同时连接数
• 每个连接允许的邮件数限制
• 收件人限制
• 全系统或虚拟网关交换机
• 按域实施限制
• 收件人时段限制（分钟）
• 退回验证
• 用于域的退回配置文件

下表在目标控制表中显示条目。

destconfig 命令的批处理格式可以用于执行传统 CLI 命令的所有功能。

• 创建新的目标控制表

  destconfig new <profile> [options]

• 编辑现有的目标控制表

  destconfig edit <default|profile> [options]

• 删除现有的目标控制表

  destconfig delete <profile>

• 显示所有目标控制条目的摘要

  destconfig list

• 显示一个目标或所有条目的详细信息

  destconfig detail <default|profile|all>

• 删除所有现有的目标控制表条目

  destconfig clear

• 从文件导入表格

  destconfig import <filename>

• 将表格导出到文件

  destconfig export <filename>

对于 edit 和 new 批处理命令，可以通过利用变量名称和等号来标识值的方式，提供以下任意或全部选项。未指定的选项不会修改（如果使用 edit），或者将设置为默认值（如果使用 new）。

concurrency_limit=<int> - The maximum concurrency for a specific host.

concurrency_limit_type=<host|MXIP> - Maximum concurrency is per host or per MX IP.

concurrency_limit_apply=<system|VG> - Apply maximum concurrency is system wide or by Virtual Gateway(tm).

max_messages_per_connection=<int> - The maximum number of messages that will be sent per connection.

recipient_limit_minutes=<int> - The time frame to check for recipient limits in minutes.

recipient_limit=<int> - The number of recipients to limit per unit of time.

use_tls=<off|on|require|on_verify|require_verify> - Whether TLS should be on, off, or required for a given host.

bounce_profile=<default|profile> - The bounce profile name to use.

bounce_verification=<off|on> - Bounce Verification option.

监控特定主机的活动

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式

mail3.example.com> hostrate
Recipient host:
[]> aol.com
Enter the number of seconds between displays.
[10]> 1
    Time      Host  CrtCncOut   ActvRcp ActvRcp  DlvRcp HrdBncRcp SftBncEvt
            Status                        Delta   Delta     Delta     Delta
23:38:23        up          1         0       0       4         0         0
23:38:24        up          1         0       0       4         0         0
23:38:25        up          1         0       0      12         0         0
^C

使用 Ctrl+C 组合键可停止 hostrate 命令。

获取指定主机名的状态。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式

mail3.example.com> hoststatus

Recipient host:
[]> aol.com
Host mail status for: 'aol.com'
Status as of:         Fri Aug  8 11:12:00 2003
Host up/down:         up
Counters:
  Queue
    Soft Bounced Events                        0
  Completion
    Completed Recipients                       1
      Hard Bounced Recipients                  1
        DNS Hard Bounces                       0
        5XX Hard Bounces                       1
        Filter Hard Bounces                    0
        Expired Hard Bounces                   0
        Other Hard Bounces                     0
      Delivered Recipients                     0
      Deleted Recipients                       0
Gauges:
  Queue
    Active Recipients                          0
      Unattempted Recipients                   0
      Attempted Recipients                     0
    Connections
      Current Outbound Connections             0
      Pending Outbound Connections             0
Oldest Message        No Messages
Last Activity         Fri Aug  8 11:04:24 2003
Ordered IP addresses: (expiring at Fri Aug  8 11:34:24 2003)
    Preference   IPs
    15           64.12.137.121    64.12.138.89     64.12.138.120    
    15           64.12.137.89     64.12.138.152    152.163.224.122  
    15           64.12.137.184    64.12.137.89     64.12.136.57     
    15           64.12.138.57     64.12.136.153    205.188.156.122  
    15           64.12.138.57     64.12.137.152    64.12.136.89     
    15           64.12.138.89     205.188.156.154  64.12.138.152    
    15           64.12.136.121    152.163.224.26   64.12.137.184    
    15           64.12.138.120    64.12.137.152    64.12.137.121    
MX Records:
    Preference   TTL        Hostname
    15           52m24s     mailin-01.mx.aol.com
    15           52m24s     mailin-02.mx.aol.com
    15           52m24s     mailin-03.mx.aol.com
    15           52m24s     mailin-04.mx.aol.com
    Last 5XX Error:
    ----------           
    550 REQUESTED ACTION NOT TAKEN: DNS FAILURE
    (at Fri Aug  8 11:04:25 2003)
    ----------
Virtual gateway information:
============================================================
example.com (PublicNet_017):
    Host up/down:		up
    Last Activity		Wed Nov 13 13:47:02 2003
    Recipients		0
============================================================
example.com (PublicNet_023):
    Host up/down:		up
    Last Activity		Wed Nov 13 13:45:01 2003
    Recipients		

配置 IronPort 图像分析设置

提交：此命令需要“提交”。

群集管理：此命令可用于所有三种计算机模式（群集、分组、计算机）。

批处理命令：此命令不支持批处理格式

mail.example.com>imageanalysisconfig
IronPort Image Analysis: Enabled
Image Analysis Sensitivity: 65
Verdict Ranges: Clean (0-49), Suspect(50-74), Inappropriate (75+)
Skip small images with size less than 100 pixels (width or height)

(First time users see the license agreement displayed here.)
Choose the operation you want to perform:
- SETUP - Configure IronPort Image Analysis.
[]> setup
IronPort Image Analysis: Enabled
Would you like to use IronPort Image Analysis? [Y]>
Define the image analysis sensitivity. Enter a value between 0 (least sensitive) and 100 (most sensitive). As sensitivity increases, so does the false
positive rate. The default setting of 65 is recommended.
[65]>
Define the range for a CLEAN verdict. Enter the upper bound of the CLEAN range by entering a value between 0 and 98. The default setting of 49 is
recommended.
[49]>
Define the range for a SUSPECT verdict. Enter the upper bound of the SUSPECT range by entering a value between 50 and 99. The default setting of 74 is
recommended.
[74]>
Would you like to skip scanning of images smaller than a specific size? [Y]>
Please enter minimum image size to scan in pixels, representing either height or width of a given image.
[100]>
IronPort Image Analysis: Enabled
Image Analysis Sensitivity: 65
Verdict Ranges: Clean (0-49), Suspect(50-74), Inappropriate (75+)
Skip small images with size less than 100 pixels (width or height)
Choose the operation you want to perform:
- SETUP - Configure IronPort Image Analysis.
[]>

显示系统上最早的非隔离区邮件的中间部分和信头

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

在下面的示例中，会显示最早的邮件：

mail3.example.com> 
oldmessage
MID 9: 1 hour 5 mins 35 secs old
Received: from test02.com ([172.19.0.109])
by test02.com with SMTP; 14 Feb 2007 22:11:37 -0800
From: user123@test02.com
To: 4031@example.com
Subject: Testing
Message-Id: <20070215061136.68297.16346@test02.com

监控邮件吞吐量

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail3.example.com> rate

Enter the number of seconds between displays.
[10]> 1
Hit Ctrl-C to return to the main prompt.
Time     Connections Recipients          Recipients               Queue
            In   Out   Received    Delta  Completed    Delta     K-Used
23:37:13    10     2   41708833        0   40842686        0         64
23:37:14     8     2   41708841        8   40842692        6        105
23:37:15     9     2   41708848        7   40842700        8         76
23:37:16     7     3   41708852        4   40842705        5         64
23:37:17     5     3   41708858        6   40842711        6         64
23:37:18     9     3   41708871       13   40842722       11         67
23:37:19     7     3   41708881       10   40842734       12         64
23:37:21    11     3   41708893       12   40842744       10         79
^C

将所有邮件重定向到另一个中继主机。

危险	将邮件重定向至目标为 /dev/null 的接收域会导致邮件丢失。如果您将邮件重定向至这种域，那么 CLI 就不会显示警告。在重定向邮件之前，请检查接收域的 SMTP 路由。

危险	如果将收件人重定向到尚未准备好从此主机接受大量 SMTP 邮件的主机或 IP 地址，将会导致邮件退回，并可能导致邮件丢失。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令支持批处理格式。

redirectrecipients 命令的批处理格式可以用于执行传统 CLI 命令的所有功能。

• 将所有邮件重定向到另一主机名称或 IP 地址

  redirectrecipients host <hostname>

以下示例将所有邮件重定向至 example2.com 主机。

mail3.example.com> redirectrecipients
Please enter the hostname or IP address of the machine you want to send all mail to.
[]> example2.com
WARNING: redirecting recipients to a host or IP address that is not prepared to accept large volumes of SMTP mail from this host 
will cause messages to bounce and possibly result in the loss of mail.
Are you sure you want to redirect all mail in the queue to "example2.com"? [N]> y
Redirecting messages, please wait.
246 recipients redirected.

重置系统中的所有计数器

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

mail3.example.com> resetcounters
Counters reset: Mon Jan 01 12:00:01 2003

尝试安全删除特定邮件 ID 的邮件。

removemessage 命令只能删除位于工作队列、重试队列或目标队列中的邮件。请注意，有效邮件和活动邮件可能不在上述任意队列中，这取决于系统状态。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

example.com> 
removemessage
Enter the MID to remove.
[]> 1
MID 1: 19 secs old
Received: from example2.com ([172.16.0.102])
  by test02.com with SMTP; 01 Mar 2007 19:50:41 -0800
From: user123@test02.com
To: 9526@example.com
Subject: Testing
Message-Id: <20070302035041.67424.53212@test02.com>
Remove this message? [N]> y

显示指定邮件 ID 的邮件和邮件正文。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令不支持批处理格式。

example.com> showmessage
MID 9: 1 hour 5 mins 35 secs old
Received: from example2.com([172.19.0.109])
  by test02.com with SMTP; 14 Feb 2007 22:11:37 -0800
From: user123@test02.com
To: 4031@example.com
Subject: Testing
Message-Id: <20070215061136.68297.16346@test02.com>
This is the message body.

按收件人主机、信封收件人地址显示队列中的邮件，或显示所有邮件。

提交：此命令不需要“提交”。

群集管理：此命令仅限在计算机模式下使用。

批处理命令：此命令支持批处理格式。

showrecipients 命令的批处理格式可以用于执行传统 CLI 命令的所有功能。

• 按收件人主机名称查找邮件

  showrecipients host <hostname>

• 按信封收件人地址查找邮件

  showrecipients [sender_options] <sender_email>

下面的 sender_option 可用：

--match-case 地址的用户名部分大小写匹配。

• 查找所有邮件

  showrecipients all

以下示例显示所有收件人主机队列中的邮件。

mail3.example.com> showrecipients
Please select how you would like to show messages:
1. By recipient host.
2. By Envelope From address.
3. All.
[1]> 3
Showing messages, please wait.
MID/     Bytes/    Sender/                 Subject
[RID]    [Atmps]   Recipient
1527     1230      user123456@ironport.com Testing
[0]      [0]       9554@example.com
1522     1230      user123456@ironport.com Testing
[0]      [0]       3059@example.com
1529     1230      user123456@ironport.com Testing
[0]      [0]       7284@example.com
1530     1230      user123456@ironport.com Testing
[0]      [0]       8243@example.com
1532     1230      user123456@ironport.com Testing
[0]      [0]       1820@example.com
1531     1230      user123456@ironport.com Testing
[0]      [0]       9595@example.com
1518     1230      user123456@ironport.com Testing
[0]      [0]       8778@example.com
1535     1230      user123456@ironport.com Testing
[0]      [0]       1703@example.com
1533     1230      user123456@ironport.com Testing
[0]      [0]       3052@example.com
1536     1230      user123456@ironport.com Testing
[0]      [0]       511@example.com