We recently found out that we were blacklisted due to some machine in the organization sending out spam messages. I am trying to monitor port 25 on our ASA firewall to determine which machine is sending the emails. I looked around the ASDM gui for the ASA and did not see any options. Im hoping some expert out there can give me some help in either finding where I can do this or a way to monitor only port 25.
Thanks
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
HI,
I advise to use netflow, whisch helps you to find the recent activities, please refer this pages:
http://www.cisco.com/en/US
http://www.cisco.com/en/US
I advise to use this programs:
www.ntop.org/nProbe.html
http://www.plixer.com/
Dont forget to update your ASA to 8.2x
Good catch IKA, I didn't see that the ASA started to support netflow.
Xxdcmast just keep in mind that the ASA requires 8.2 code, as IKA stated, but will only support Netflow V9.
or
You can just right click on the Hits line of the deny acl you wrote for SMTP in the ASDM and select show log see who is still trying to send mail out and is being blocked.
Regards,
3nerds
or if you don't want to upgrade it 8.2, I advise to try firewall log analyzer, the output seems netflow:
http://www.manageengine.co
I like it, try it:)
Business Accounts
Answer for Membership
by: 3nerdsPosted on 2009-09-01 at 13:58:56ID: 25236012
2 different things.
First add an acl blocking SMTP out the inside interface for every thing except you email server. This will at least allow you to apply for removal from the list.
From this you can also turn on logging for the deny statement and see what machines are hitting the list.
Beyond that there is some basic tracking functionality in the new ASDM versions on the firewall dashboard.
Let me know if you have specific questions about any of this.
Regards,
3nerds