Open tcp port 993 on firewall

[acira]

I currently have two PIX515 firewalls (v4.4 and v6.2) how to do I add a fixup protocol imap4 993 for SSL?

I want to add a conduit to from a specific server ip. I can't setup a secure channel without this port being open.

Thanks in Advance.

[Patrick Iseli]

There does not exist a fixup for imap !

Fixup protocols are built in into the PIX Firewall OS and cannot be added.

See: Command Reference:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094885.shtml

Please change your conduits to access-list, Cisco does not support any more the conduits.

You will need a static for NATing the IP to your Mail server and an access-list on the outside interface to permit traffic inbound.

See example:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008015efa9.shtml

http://www.cisco.com/pcgi-bin/Support/browse/psp_view.pl?p=Hardware:PIX&s=Software_Configuration

sincerely

Patrick

[acira]

You are correct, the documentation for v4.4 and v6.2 confirms that the imap4 protocol is not supported.

Besides the default protocols on v4.4 and v6.2, can generic protocols be created with associated port by submitting some command line entries?

[Patrick Iseli]

You talk about filtering out commands from a specific protocol as IMAP?

No, that is not possible with a PIX.

You can block this on an IDS or IPS system.

I don't know if there is a way in an IOS Router, maybe with NBAR?

Has someone an idea?

[Patrick Iseli]

How about a Mail Relay Server ?

[acira]

Do you mean setting up an Exchange Front End server, in front of the firewall, to accept 993 traffic and relay to the mailboxes on the back-end behind the firewall? This sounds like more work than I want. I don't want to disturb the existing infrastructure. Any other suggestions?

[Patrick Iseli]

No, I do not have another suggestion.

A Mail relay Server is usully located in the DMZ and relay into the Mail server located in the inside LAN.

The same setup can be used to protect against SPAM and Viruses.

e.g. http://www.esafe.com

This is usally used for SMTP but I imagine there exists also products that limits IMAP commands.

http://www.squid-cache.org/ for http and SSL

sincerely

Patrick