topic Re: ASA and inspect esmtp in Network Security

ASA and inspect esmtp

ttran — Mon, 11 Mar 2019 16:36:43 GMT

Our ASA is running code 8.0.4 and our smtp mail inbound and outbound working fine, then it was broken. Check the ASA and the inspect esmtp is on by default and this working before. The mail library was updated and nothing is working. Researched and found out that by removing inspect esmtp and mail is working again. I would like to keep the inspect esmtp on for security purpose but need to find a work around solution. Please let me know if there is a work around for this.

Thank you.

Re: ASA and inspect esmtp

mkharban — Thu, 05 Nov 2009 23:36:56 GMT

Hi,

Kindly understand the functionality of 'inspect esmtp' first.

Please visit the following link for information on the same:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/i2.html#wp1719425

Assuming the receiving MTA is indicating that it supports Binary Chunking, and that implies that the binary data (BDAT) verb is also supported. However, the ASA does not support the BDAT verb and will XXXX it out. When the receiving MTA gets the Xed out command, it will send back a 500 (Unrecognized command) to the sending MTA. The sending MTA (in the case of Microsoft) then Resets (RSET) the connection. This causes mails to be unable to be sent. The problem here is with the ASA. This can be clearly seen by applying captures on the outside interface of the firewall with an error code of 500.

To rectify this please make a custom esmtp policy map like one configured in the below given example:

policy-map type inspect esmtp _default_esmtp_map

match ehlo-reply-parameter others

mask

Please apply this policy map on the outside interface. This will ensure esmtp inspection being turned on and also allowing BDAT connection to pass through the firewall masking them instead of Xing them.

Hope this helps!

Thanks,

Manish

Re: ASA and inspect esmtp

ttran — Fri, 06 Nov 2009 14:48:29 GMT

Manish,

You are certainly helping alot and thank you for the link and this is good. Just to clear my confusing since I read so many different documents so I will keep the inspect esmtp on the global policy and add the custom esmtp as in the example or remove the the inspect esmtp and add the custom esmtp. Please let me know.

Re: ASA and inspect esmtp

mkharban — Fri, 06 Nov 2009 17:28:33 GMT

Hi,

We will have to keep only the custom inspection turned on in order to get this working. Kindly apply the same and let me know how it goes.

Hope this helps!

Thanks,

Manish

Re: ASA and inspect esmtp

ttran — Fri, 06 Nov 2009 18:01:28 GMT

Hi Manish,

Thanks for verification. I will apply the custom inspection like your example. Just a note on the policy-map the esmtp after the word inspect should not have the underscore to default correct?

Re: ASA and inspect esmtp

mkharban — Fri, 06 Nov 2009 18:45:24 GMT

Hi,

You can alter the name according to yourself. I just stated that as an example.

Thanks,

Manish

Re: ASA and inspect esmtp

ttran — Tue, 10 Nov 2009 14:52:53 GMT

Manish,

It is working. Thank you. 5 for you.