ESA not updating to senderbase

[slicciardola]

Hi all,

i've updated my appliances to the latest asyncos versions.

next i reconnected the cluster but i cannot connect anymore to senderbase.

this is the situation from CLI:

SenderBase Host Status
Host success/fail: Unknown (never contacted)

SBRS Status
Host success/fail: Unknown (never contacted)

repengstatus

Component Last Update Version
Reputation Engine 05 Jun 2017 09:44 (GMT +00:00) 1.2.0-079
Reputation Engine Tools 05 Jun 2017 09:44 (GMT +00:00) 1.2.0-079

i've already tried a manual repengupdate force, but with no success.

Any help would really be appreciated.

Thanks!

[Libin Varghese]

Hi,

I've normally seen this when there is no active mail flow on the appliance from public IP addresses.

The sbstatus shows never contacted till it gets a connection from a public IP address it can lookup on senderbase.

Thank You!

Libin Varghese

[slicciardola]

Hi Libin,

thanks for the answer, this is the nslookup command result from the CLI

(Machine xxxxxxxxxxx)> nslookup

Please enter the host or IP address to resolve.
[]> senderbase.org

Choose the query type:
1. A the host's IP address
2. AAAA the host's IPv6 address
3. CNAME the canonical name for an alias
4. MX the mail exchanger
5. NS the name server for the named zone
6. PTR the hostname if the query is an Internet address,

otherwise the pointer to other information
7. SOA the domain's "start-of-authority" information
8. TXT the text information
[1]> 1

A=23.0.174.27 TTL=30m
A=23.0.174.19 TTL=30m

thanks

[Libin Varghese]

Apologies. I wasn't referring to looking up DNS records for senderbase.org.

When there is active mail flow on the appliance, the ICID from a public IP address would be looked up on senderbase automatically.

Is this device currently handling email flow from the internet.

- Libin V

[slicciardola]

oh ok, no, this is still a "test" cluster even if configured with up to 2020 licensing.

i've to switch and old infrastructure to this one.

So until i will put it in production i will not be able to connect to senderbase?

[Libin Varghese]

That would be accurate.

Senderbase success would mean able to connect to senderbase, failure would mean unable to connect and unknown just signifies it hasn't had the opportunity to connect to senderbase yet.

The device would connect to the senderbase only when required, hence the output.

You could telnet to the lab device from somewhere within your network which has a public IP address over port 25 to perform the lookup. Private IP addresses would not work.

- Libin V

[slicciardola]

so you mean?

make a telnet from the esa to?

[Libin Varghese]

No. Telnet to the ESA over port 25 from any system with a public IP address.

If the connection reaches the ESA it would lookup the reputation for that IP address.

- Libin V

[slicciardola]

ESA is not yet natted to the external world, but only visible in our network.

[Libin Varghese]

Would need to wait for active mail flow, then.

You could try using System Administration -> Trace feature on that device, however there are a few defects that suggest it does not fetch the SBRS score and just displays N/A on trace.

- Libin V

[slicciardola]

hi, the trace option for? what?

[Libin Varghese · Accepted solution]

Trace emulates a message as being accepted by a listener and prints a summary of features that would have been “triggered” or affected by the current configuration of the system (including uncommitted changes).

http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118102-troubleshoot-esa-00.html

- Libin V

[slicciardola]

done.

simulating a trace woke up senderbase contact!

thanks

[Libin Varghese]

Glad to hear it worked.

- Libin V