2

We have a Cisco ASA 5505 (version 8.0(4)) that is preventing outbound SMTP traffic; testing with telnet shows connections on port 25 are having everything converted to *s while the same does not happen if the SMTP server is moved to port 26

On port 25:
220 ***************************

On port 26:
220 fuber.uberconsult.com ESMTP

The rewriting also converts the outbound commands, but to X's instead of *'s. If I send "HELO foo.com" the server gets "XXXX XXXXXXX"

Presumably there is a security setting somewhere on the ASA that is doing this, I'd guess as some form of "adaptive" security, but where is this setting and how do I disable it?

5

When we first set our 5510 up, we had a similar problem and I figured out it was easiest just to disable SMTP packet inspection entirely.

Take a look at what you have for:

yourfirewall# show running-config policy-map

If there's anything about esmtp in there, you can disable it with:

yourfirewall# configure terminal
yourfirewall(config)# policy-map global_policy
yourfirewall(config-pmap)# class inspection_default
yourfirewall(config-pmap-c)# no inspect esmtp

I believe you can do the same in ASDM, by looking in Firewall -> Objects -> Inspect Maps -> ESMTP

0
2

i'am wondering if you also could fix this issue without globaly disable esmtp inspections. when configuring an own inspection map, there is a parameter called "no mask-banner" this will prevent the ASA from rewriting the banner with ****

  policy-map type inspect esmtp new_estmp_inspect_map
    parameters
      no mask-banner

  policy-map global-policy
    class class-default
      inspect esmtp new_esmtp_inspect_map
  service-policy global-policy global

the advantage instead of deactivating is, that you are still able inspect other criterias like:

    match sender-address length ..
    match mime filename length ..
    match cmd line length ..
    match cmd rcpt count ..
    match body line length ..
1

ASA 5506X not only by default masks SMTP banner, but also scrambles ehlo replies, like shown below, where XXXX are ASA inventions. They must have a fancy idea about security those who implemented this "feature".

Anyway. I had no clue that the default filtering was on for ESMTP, as the graphical interfaces shows no rule and lowest security.

ehlo example.com
250-email.example.net Hello [hidden IP] 
250-SIZE 
250-PIPELINING 
250-DSN 
250-ENHANCEDSTATUSCODES 
250-XXXXXXXA 
250-AUTH 
250-8BITMIME 
250-BINARYMIME
250 XXXXXXXB

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.