IronPort alias provisioning

[schekardzhikova]

Hello,

I am looking for a way to automate alias provisioning to iron port.

Is there a way to have a scheduled script provision the aliases?

Thank you

[Ken Stieers]

Not really a cron job you can grab... you'd have to do it from outside, and write some scripting...

Which aliases and how/where are you using them?  We may be able to help if we knew the whole story.

[schekardzhikova]

Thank you for your reply.

Currently we are entering aliases manually in the SSH client, which is time consuming.

What I am looking for, is some outside script that can read the aliases from a file or SQL table. I am totally up to writing a script and a sample would be really helpful.

[Ken Stieers]

I guess I wasn't clear enough in needing the whole picture.

What "aliases" are you using?  Where are you entering them?  What are you using them for?What email system are you using?

[schekardzhikova]

We are using Microsoft Exchange.

The aliases are used to redirect from one domain name to another.

For example if my email is user@contosa.com, in order to receive emails sent to this address there has to be an entry in the IronPort like this

user: user@xyz.contosa.com

The command sequence in SSH client is

- aliasconfig

- switch modes to edit at mode "Cluster"

- "Create new entry"

- pick "contosa.com" domain name

- provide the username entry

Thank you for your help

[Ken Stieers]

Are all of your aliases one to one, and simple like that? if so you could use a domain map.

This is also what a masquerade query will do, but the data has all be in AD (which at that point, the easiest way to do that is to put it in via Exchange Email Address Policies, so you could just use an accept query to keep false addresses out and pass everything to Exchange).

I have tracked down some scripting stuff, I'll post that and a sample in a bit.

[schekardzhikova]

Script will work better for us. We have some exceptions.

But I would like to look into domain map and Exchange Email Address Policies way. Do you have a link on how this can be done?

[Ken Stieers]

So, domain map is covered in the help file on the box.

More detail can be found here:http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa8-5-6/ESA_8-5-6_User_Guide.pdf

Page 616 of the PDF/ Chapter 23, pg 28

What version of Exchange are you running?

[schekardzhikova]

Thank you.

The Exchnage version is 2010

[Ken Stieers]

In the Exchange Management Console click on Organizational Configuration, then Hub Transport, then in the right pane, click Email Address Policies.

Here you'll find a list of policies, or maybe just the Default.

Using these policies, each object in Exchange gets assigned a set of addresses. There are various ways to filter who gets what.  For example, if everyone on a specific server, or everyone with their Company set to a certain value in AD.

Go carefully, because once you add it, and run the policy, you can't "remove" the addresses you give to people just by removing the policy.  You have to either script it some way, or do it by hand...

Once everyone has their addresses, you use SMTP Routes on the ESA to point mail for the domain to the Exchange boxes.

http://technet.microsoft.com/en-us/library/aa998940(v=exchg.141).aspx

I'm curious as to how you ended up here, using aliases versus using Exchange, as what you have is such a manual process.  I'd hate to steer you the wrong direction because I don't know the environment you're dealing with...

[schekardzhikova]

Thank you for your help.

It seems that we also use it for whitelist and spam filtering. We do not provision all accounts, some are left out.

Therefore I still have to go with entering these aliases to Ironport, so if there is any script that could substitute this, it would be really helpful!

Thank you.

[schekardzhikova]

Script will work better for us. We have some exceptions.

But I would like to look into domain map and Exchange Email Address Policies way. Do you have a link on how this can be done?