Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a Cisco ASA 5505 (version 8.0(4)) that is preventing outbound SMTP traffic; testing with telnet shows connections on port 25 are having everything converted to *s while the same does not happen if the SMTP server is moved to port 26

On port 25:
220 ***************************

On port 26:

The rewriting also converts the outbound commands, but to X's instead of *'s. If I send "HELO" the server gets "XXXX XXXXXXX"

Presumably there is a security setting somewhere on the ASA that is doing this, I'd guess as some form of "adaptive" security, but where is this setting and how do I disable it?

share|improve this question
up vote 5 down vote accepted

When we first set our 5510 up, we had a similar problem and I figured out it was easiest just to disable SMTP packet inspection entirely.

Take a look at what you have for:

yourfirewall# show running-config policy-map

If there's anything about esmtp in there, you can disable it with:

yourfirewall# configure terminal
yourfirewall(config)# policy-map global_policy
yourfirewall(config-pmap)# class inspection_default
yourfirewall(config-pmap-c)# no inspect esmtp

I believe you can do the same in ASDM, by looking in Firewall -> Objects -> Inspect Maps -> ESMTP

share|improve this answer
Perfect - thank you – DrStalker Mar 4 '10 at 4:11

i'am wondering if you also could fix this issue without globaly disable esmtp inspections. when configuring an own inspection map, there is a parameter called "no mask-banner" this will prevent the ASA from rewriting the banner with **

  policy-map type inspect esmtp new_estmp_inspect_map
      no mask-banner

  policy-map global-policy
    class class-default
      inspect esmtp new_esmtp_inspect_map
  service-policy global-policy global

the advantage instead of deactivating is, that you are still able inspect other criterias like:

    match sender-address length ..
    match mime filename length ..
    match cmd line length ..
    match cmd rcpt count ..
    match body line length ..
share|improve this answer

ASA 5506X not only by default masks SMTP banner, but also scrambles ehlo replies, like shown below, where XXXX are ASA inventions. They must have a fancy idea about security those who implemented this "feature".

Anyway. I had no clue that the default filtering was on for ESMTP, as the graphical interfaces shows no rule and lowest security.

ehlo Hello [hidden IP] 
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.