Blocking outbound SMTP on PIX 515 -Ver 6.3.(4)

[fortis123]

One of my client received emails from ISP saying the SPAM email generated from their network with PIX outside ip. We want to disable the outbound SMRP (port25) on the firewall, so that the emails will be stopped. PIX config has 'no fixup protocol smtp 25'.

Is there any way I can use the fixup to block the outbound SMTP (without impacting any other services)

or do I need to create a ACL for port25 and apply on the inside interface..?

TIA

MS

[Collin Clark]

You need to create an ACL and apply it to the inside interface.

[fortis123]

Thank you...

So.. below config is enough or any additional lines needed?

*********************************

access-list BLOCKSMTP extended deny tcp 192.168.x.x 255.255.0.0 any eq 25

access-list BLOCKSMTP extended permit ip any any

access-group BLOCKSMTP in interface INSIDE

*********************************

Thanks again

MS

[Collin Clark]

Looks good. You don't have an email server inside correct?

[fortis123]

Correct. Not at this location. The other location server does not use this Internet connection for any outbound SMTP comminication.

Thanks

MS

[fortis123]

slight correction to ACL... 'extended' key word does not support on 6.3(4).

[fortis123]

question.. I want to enable 'log' with the ACL to see what is the source. It may be hard to tell, but will there be any perf. impact on the PIX as it has to inspect every packet against ACL..?

TIA

MS

[Collin Clark]

It will already inspect every packet with the ACL. Now it will just log an entry which has low overhead.

[fortis123]

The SPAM stopped but unable to find the source IP. I tried port 25 to Internet from known PC, the hit count in ACL increases but PIX logging anythign about the souce (internal PC) in buffer or syslog. I observed few messages in PIX log that the deny flow-max is reached(1024).. it is not letting me increase the count. Anyway I can find source address (tried with no avail by changing logging buffered informational) without placing a sniffer..?

ACL on PIX:

*****************************************

access-list BLOCKSMTP extended deny tcp any any eq 25 log 7 interval 600

access-list BLOCKSMTP extended permit ip any any

access-group BLOCKSMTP in interface INSIDE

*****************************************

TIA

MS

[Collin Clark]

Check this link-

https://packetpros.com/images/asa_logging.GIF

You will have to have your buffer logging to Information or higher to see the ACL logging.

[fortis123]

Thanks again Collin. It worked with 'debugging' leved enabled.

MS