Solved

How To Use Fixup Protocol SMTP in Cisco ASA 5510

Posted on 2007-11-17
9
57,486 Views
Last Modified: 2013-11-30
We have been having issues with Bounced Emails at random and mostly Gmail getting bounced to our Exchange server. We are using Microsoft's FrontBridge Filtering service. They have reccomended the foillowing:  
I have contacted our operations and we were able to determine that this issue that you are experiencing with the deferrals may be due because you are using a Cisco firewall. At this time there is a known compatibility issue between Cisco and Postfix. In order to get this resolved you may want to disabled the fixup protocol on the SMTP.
For further questions in regards to this issue you may want to visit the following link http://support.microsoft.com/kb/295725. Please note that when we do a telnet session we receive the following:

My question, I cannot figure out how to disable the postfix or fixup command. I have tried using this string at the command prompt after ENABLING:  FIXUP PROTOCOL SMTP.
There does not appear to be any command for FIXUP.
I dont see anything on the ASDM GUI either.

** UPDATE **

I was forgetting to issue the: CONFIG T command.
I now was able to issue the FIXUP command and disable the feature.

I would like to get any and all input on this issue if there are others that have some advise.


Please advise.

Thanks.
0
Comment
Question by:icarus2256
9 Comments
 
LVL 16

Accepted Solution

by:
grahamnonweiler earned 125 total points
ID: 20305791
To remove "fixup" on SMTP...

If you have access to ASDM then:

Configuration --> Service Policy Rules -->  General/Global Policy --> Edit ---> Rule Actions --> Untick ESMTP

Click OK --> Apply --> Save


If you do not have ASDM (which I would recommend you get as it really does save a lot of time) then the PIX CLI is:

en
(password)
conf t
no fixup protocol smtp 25
(ctrl+z)
wr me
exit



0
 
LVL 11

Expert Comment

by:tvman_od
ID: 20305859
I think CLI is perfectly fine.
Just my 2 cents. Postfix is a name of SMTP server. It has nothing to do with fixups. What fixup does that it looks for SMTP protocol anomalies and drops connection when something is going wrong. Because SMTP is changing and servers and clients start using new features, or include some new stuff into headers which PIX doesn't understand it drops perfectly fine connections. Actually you need to get your PIX and SMTP server upgraded to the latest version.
0
 
LVL 16

Expert Comment

by:grahamnonweiler
ID: 20305921
I believe the version of PIX on the 5510 is the latest version - that aside the particular problem presented by Cisco's SMTP FIXUP is normally due to the way it handles EHLO - in that it more often than not strips out server signatures and on occasions the initial 220/200 codes. So as opposed to the Cisco dropping the connection it is the sending SMTP server that drops the connection as it is not able to verify the receivers signature.


0
 
LVL 79

Expert Comment

by:lrmoore
ID: 20307234
ASA 5510 does not support FIXUP commands. Instead, it uses inspect policies.
ESMTP inspect is a new feature of the ASA and supports EHLO. However, there are bugs in this in early 7.x versions of asa/pix
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 16

Expert Comment

by:grahamnonweiler
ID: 20307275
lrmoore: usefull information - I wasn't sure if the ESMTP policy it was "SMTP" fixup of old! The 5505 uses the same policy inspect rules as the 5510 and I had to disable the policy there.
0
 

Expert Comment

by:smhill
ID: 20315323
Wow, this thread just saved me a bunch of trouble.  I just bought a Cisco ASA 5505, and I was having trouble with receiving mail from our external postfix server.  I tried dropping the MTU on the external server, the internal server, and the outside interface of the firewall, but nothing was fixing the problem.  I ran "no fixup protocol smtp 25", as per grahamnonweiler's post, and now it is working without a problem.

Thanks!
0
 
LVL 16

Expert Comment

by:grahamnonweiler
ID: 20838568
No objection to deletion, however no points should be refunded as asker never even bothered to respond to any of the experts, and now 2 months later asks for deletion!
0
 

Author Closing Comment

by:icarus2256
ID: 31409748
If you read at the bottom of my original question, I found the problem.
I just forgot to delete then.
Will give you full anyway as you did answer correctly.

Thanks.
0
 

Expert Comment

by:funkyone60
ID: 37134695
I had this same exact problem that did not start until I upgraded to the latest frimware on my 5510.  I made the change in ASDM as suggested and the problem wnet away immediately- 190 emails in que dropped to 5

Thanks
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

How to configure Site to Site VPN on a Cisco ASA.     (version: 1.1 - updated August 6, 2009) Index          [Preface]   1.    [Introduction]   2.    [The situation]   3.    [Getting started]   4.    [Interesting traffic]   5.    [NAT0]   6.…
What is Usenet? There are many different opinions on exactly what Usenet is an isn't. Many opinions are incorrect simply out of ignorance. The Wikipedia listing about Usenet does a good job of explaining it, so instead of repeating it all here I wi…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now