Hi,
IronPort is a bit problematic. NCM can grab the config, but as the device has no option to disable pagination ("more" prompt), so some lines in the config may get broken.
The alternative way would be transferring the config file via TFTP or SCP, but IronPorts can't do that, as far as I know.
Regards,
Jiri