Re: PIX 515 and e-mail problems

chrishall · ‎01-23-2003

Hi everyone,

We're having problems downloading POP3 mail from our ISP and I'm trying to look at all avenues. It appears that during the retrieval process, there is a timeout and the message fails to download. The only messages we are having problems with, have attachments of type PDF or Excel and larger than 1 Mb. I am working with another vendor on a box that scans all http and pop3 traffic, but they have not been able to reproduce our problem. This box is connected to the fw with a crossover cable and a second nic is connected to a hub with a cat 5 cable. We don't have any connectivity problems--traffic goes in, traffic goes out. I have ruled out the client as an issue, whereas, I've tried two different clients and have the same problem with both.If messages were getting stuck at the fw where would I go to see this? Any suggestions on how the fw might be involved on this problem?

If anyone has any insight, I would appreciate the assistance.

Chris

mpalardy · ‎01-23-2003

Hello Chris,

It would be very doubtfull that only PDF ans XLS file are restrain

On your PIX, take a look at this command "fixup protocol smtp 25". Some commands of SMTP protocol are not process on the PIX. Not sure what's the fixup for POP3 but it may give you a hint.

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/cmdref/df.htm#1067379

Also your SMTP server may be configured to discard e-mail witch contains attachments larger than 1Mb.

Good luck,

Michael

chrishall · ‎01-23-2003

Thanks for the reply, Michael. I'll take a look at this.

chrishall · ‎01-28-2003

Michael,

I looked at the documentation from the link above, but I guess I'm not sure what I'm looking for....we do have fixup protocol smtp 25, but not sure where to go from there...I haven't seen any info about a fixup for pop3 at this point. We haven't had any problems receiving pop traffic in general, so I'm not sure if that would be the direction to pursue. Would it be possible that a mail message that is being scanned could take a few minutes and trigger some kind of timeout on the fw? And if so, would it then disconnect the session?

mpalardy · ‎02-06-2003

Sorry for the delay, I just came back.... is everything ok now?

You may set this command on your PIX: no fixup protocol smtp 25

But be sure your SMTP server can handle unsecure commands from SMTP protocol.

Also check your PIX log's. You may have error similar to

"too many connection" under heavy traffic condition.

shannong · ‎02-10-2003

Fixup for SMTP has NO EFFECT on POP3 access. This is not you're problem.

Unless you have a high level of interface errors or the pix is CPU bound for some reason, I highly doubt the firewall is your problem.

chrishall · ‎02-11-2003

Thanks for the reply.