Disable esmtp Inspection for Specific Host

[cer43tcent]

Hello.  Is it possible to disable esmtp inspection for a specific INSIDE host with use of a policy-map?  If so, could you provide an example configuration.
 

[Marius Gunnerud]

Yes it is possible.  You could do something like the following:

access-list ESMTP deny ip host 1.1.1.10 any
access-list ESMTP permit ip 1.1.1.0 255.255.255.0 any

class-map CMAP
match access-list ESMTP

policy-map PMAP
class CMAP
inspect esmtp

service-policy PMAP interface inside

--

Please remember to select a correct answer and rate helpful posts

[marcosespinatrigo]

Hi! 

In this case, besides those commands wouldn´t be necessary to disable default esmtp inspection from the by-default global-policy as well?? Like this:

policy-map global_policy
class inspection_default
no inspect esmtp

thanks in advance

[Marius Gunnerud]

You can disable default esmtp inspection like that, but cer43tcent wants to disable it for a single or specific internal addresses.  So for that you would need to define the addresses to be excluded and then define all the other addresses that are to be inspected.

--

Please remember to select a correct answer and rate helpful posts