Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a Cisco ASA 5505 (version 8.0(4)) that is preventing outbound SMTP traffic; testing with telnet shows connections on port 25 are having everything converted to *s while the same does not happen if the SMTP server is moved to port 26

On port 25:
220 ***************************

On port 26:
220 fuber.uberconsult.com ESMTP

The rewriting also converts the outbound commands, but to X's instead of *'s. If I send "HELO foo.com" the server gets "XXXX XXXXXXX"

Presumably there is a security setting somewhere on the ASA that is doing this, I'd guess as some form of "adaptive" security, but where is this setting and how do I disable it?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

When we first set our 5510 up, we had a similar problem and I figured out it was easiest just to disable SMTP packet inspection entirely.

Take a look at what you have for:

yourfirewall# show running-config policy-map

If there's anything about esmtp in there, you can disable it with:

yourfirewall# configure terminal
yourfirewall(config)# policy-map global_policy
yourfirewall(config-pmap)# class inspection_default
yourfirewall(config-pmap-c)# no inspect esmtp

I believe you can do the same in ASDM, by looking in Firewall -> Objects -> Inspect Maps -> ESMTP

share|improve this answer
    
Perfect - thank you –  DrStalker Mar 4 '10 at 4:11

i'am wondering if you also could fix this issue without globaly disable esmtp inspections. when configuring an own inspection map, there is a parameter called "no mask-banner" this will prevent the ASA from rewriting the banner with **

  policy-map type inspect esmtp new_estmp_inspect_map
    parameters
      no mask-banner

  policy-map global-policy
    class class-default
      inspect esmtp new_esmtp_inspect_map
  service-policy global-policy global

the advantage instead of deactivating is, that you are still able inspect other criterias like:

    match sender-address length ..
    match mime filename length ..
    match cmd line length ..
    match cmd rcpt count ..
    match body line length ..
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.