ACE Normalization for SMTP Traffic

[wasiimcisco]

Hi,

I was facing issue with the ACE normalization and that was stopping my SMTP traffic. When i disabled it globally my SMTP traffic is working fine. But due to the audit i cannot disabled it for all the traffic. I want to disabled the normalization only for the SMTP por 25 traffic.

I am trying to create the L4 policy as mention below but unable to set the partameter require for to disable the normalization.

class-map match-any SMTP_CLASS
match port tcp eq 25

parameter-map type connection TCP_SMTP_MAP

no random-sequence-number
exceed-mss allow

 

policy-map multi-match TCP_SMTP_POLICY

What else i need to reacll in parameter-map in order to disable the normalization for SMTP traffic.

Pleae help.

[Kanwaljeet Singh]

Hi,

Normalization is enabled/disabled at interface and cannot be disabled/enabled for particular traffic. May i know what exactly is the issue? Disabling normalization is not suggested normally.

Regards,

Kanwal

Note: Please mark answers if they are helpful.

[wasiimcisco]

Hi,

My email traffic is not working when passing through the ACE. When I am disabling the normalization on the interface level HTML email is working fine.

Due to security audit i cannot disabled it for all the tarffic. I want to only disable it for SMTP traffic. How I can achive it.

[Kanwaljeet Singh]

Hi Wasim,

Let me think about it and get back to you.

Regards,

Kanwal

Note: Please mark answers if they are helpful.

[wasiimcisco]

Dear All,

Please let me know how to meet the above requirement.

[Kanwaljeet Singh]

Hi Wasim,

I don't see a way to disable normalization for a particular traffic. It will be disabled/enabled for all traffic that hits the interface. If we know why it is being denied, we can apply certain parameters which will help to resolve the issue. But we shall know why enabling normalization is affecting the traffic.

Let me know if you need my help with same.

Regards,

Kanwal

Note: Please mark answers if they are helpful.

[wasiimcisco]

Hi,

I have attached the capture when normalization was enabled (not working) and capture when normalization was disabled.

Please review and let me know how to achive this by fine tunning the parameters.

We are seeing lot of tcp retransmission error etc.

I have done some research and normalization deals with the following below mentoin parameters.

exceed-mss-----Configure behavior if a packet exceeds MSS

random-seq-num-disable----Disable TCP sequence number randomization

reserved-bits-----Configure Reserved bits in TCP header

syn-data-----Configure behavior for a SYN packet containing data

tcp-options-----Configure TCP header options

urgent-flag-----Allow/Clear Urgent flag

[wasiimcisco]

Hi,

Requesting for the reply on the above.