topic Cisco IPS SSM could not connect to SMTP host in Network Security

Cisco IPS SSM could not connect to SMTP host

thomas.green — Mon, 11 Mar 2019 21:20:44 GMT

We have an ASA5510 with the IPS ASA-SSM-10 module installed. All is working well except event notification. When sending a test email from the SSM IPS, we get the error "could not connect to SMTP host". The Exchange SMTP host does allow traffic from the IPS and ASA. I can ping to the SMTP host by IP and name. What am I missing here?

Cisco IPS SSM could not connect to SMTP host

Maykol Rojas — Tue, 06 Sep 2011 02:13:57 GMT

Hi,

Can you take some captures to see the connection from your AIP to your SMTP server? That would give us a clue of what is going on...

Mike..

Cisco IPS SSM could not connect to SMTP host

thomas.green — Wed, 07 Sep 2011 00:57:02 GMT

Mike,

Can you be more specific on how to run the captures and what specific traffic I should be capturing?

Cisco IPS SSM could not connect to SMTP host

Maykol Rojas — Wed, 07 Sep 2011 01:32:47 GMT

Sure,

What I need you to capture is the SMTP packets that the sensor will send to the SMTP server when it tried to send a notification.

Depending on the location of the SMTP server, I will need you to put a capture in the ingress interface as well on the outgoing interface for this matter.

For example, if your module has an IP on the same range as the inside network, and the SMTP server is on the outside, I will need you to apply a capture (both ways server to aip-aip to server) on the inside as well on the outside on port 25 on the ASA.

This capture should have (on the inside) the IP address of the management port of the IPS and on the outside, the translated IP.

Here is how you can take captures

https://supportforums.cisco.com/docs/DOC-1222

Mike

Check for any Antivirus in

Jagadeesan Chandran — Wed, 15 Jun 2016 22:44:23 GMT

Check for any Antivirus in the local system where the IME is running. In my case I had the antivirus blocking the port 25.