topic Re: 7.22 and SMTP in Network Security

7.22 and SMTP

ashleyw — Mon, 11 Mar 2019 09:50:26 GMT

After installing a new ASA, upgrading to 722, inbound SMTP seemed to be ok. Went on holiday for 2 weeks, when I get back I am told that we have not received emails from Cisco, Microsoft, IBM and other large companies. I blames everyone but the ASA, because emails were coming in, it was not till I did a full debug with /25 filter that I realised the ASA was stopping SMTP from these companies. I ended up with a access-list permitting "ip any any", it made no difference.

I downgraded to 7.06, and bingo, it all works.

Either I did something wrong, I don't think so as no config changes were made after the download, email just started to come in.

Anyone experienced this?

I think it is a bug, the trouble is, all looks ok, till someone tells you they did not receive an expected mail.

Re: 7.22 and SMTP

acomiskey — Wed, 21 Mar 2007 22:12:43 GMT

try this

policy-map global_policy

class inspection_default

no inspect esmtp

Re: 7.22 and SMTP

ashleyw — Wed, 21 Mar 2007 22:48:39 GMT

Tried that, did not work.

I had the config stripped down to bare minimum.

It works fine on 7.06, I am going to upgrade to 7.21 and see what happens.

Re: 7.22 and SMTP

vitripat — Wed, 21 Mar 2007 22:57:53 GMT

There were few bugs in 7.2 code regarding mails getting dropped/denied:

CSCsh35715, CSCsh33982

However, disabling esmtp inspection should have helped.

Regards,

Vibhor.

Re: 7.22 and SMTP

ashleyw — Thu, 22 Mar 2007 08:42:34 GMT

Disabling ESMTP inspection did not do anything.

I have now upgraded to 7.21, the problem is back.

Here is a log message:-

6 Mar 22 2007 08:36:13 106015 144.254.224.140 62.49.103.146 Deny TCP (no connection) from 144.254.224.140/16133 to 62.49.103.146/25 flags ACK on interface outside

The annoying this is I have not changed the configuration.

Note, the IP address is Cisco. It is also bloccking email from our ISP and Microsoft again.

I have disable ESMTP inspection, clear xlate, no change.

Re: 7.22 and SMTP

ashleyw — Thu, 22 Mar 2007 09:04:49 GMT

I have disabled ESMTP inspection, it appears to be working.

Next step is to upgrade to 7.22 and try again.

As I said before, on 7.06 with inspection, it works, 7.21 it doesn't.

Will keep you udated.

Re: 7.22 and SMTP

vitripat — Thu, 22 Mar 2007 20:07:04 GMT

If things are working with inspection disabled, then probably you are running into one of the bugs I mentioned earlier. Currently safe bet would be to have inspection disabled, till we have the release fixing the issue.

Regards,

Vibhor.

Re: 7.22 and SMTP

ashleyw — Fri, 23 Mar 2007 09:36:05 GMT

Many thanks Vibhor.

You were spot on.

I take it that I am safe to move up to V7.22?

Kind regards

Ash.