Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 58981
  • Last Modified:

How To Use Fixup Protocol SMTP in Cisco ASA 5510

We have been having issues with Bounced Emails at random and mostly Gmail getting bounced to our Exchange server. We are using Microsoft's FrontBridge Filtering service. They have reccomended the foillowing:  
I have contacted our operations and we were able to determine that this issue that you are experiencing with the deferrals may be due because you are using a Cisco firewall. At this time there is a known compatibility issue between Cisco and Postfix. In order to get this resolved you may want to disabled the fixup protocol on the SMTP.
For further questions in regards to this issue you may want to visit the following link http://support.microsoft.com/kb/295725. Please note that when we do a telnet session we receive the following:

My question, I cannot figure out how to disable the postfix or fixup command. I have tried using this string at the command prompt after ENABLING:  FIXUP PROTOCOL SMTP.
There does not appear to be any command for FIXUP.
I dont see anything on the ASDM GUI either.

** UPDATE **

I was forgetting to issue the: CONFIG T command.
I now was able to issue the FIXUP command and disable the feature.

I would like to get any and all input on this issue if there are others that have some advise.


Please advise.

Thanks.
0
icarus2256
Asked:
icarus2256
1 Solution
 
grahamnonweilerCommented:
To remove "fixup" on SMTP...

If you have access to ASDM then:

Configuration --> Service Policy Rules -->  General/Global Policy --> Edit ---> Rule Actions --> Untick ESMTP

Click OK --> Apply --> Save


If you do not have ASDM (which I would recommend you get as it really does save a lot of time) then the PIX CLI is:

en
(password)
conf t
no fixup protocol smtp 25
(ctrl+z)
wr me
exit



0
 
tvman_odCommented:
I think CLI is perfectly fine.
Just my 2 cents. Postfix is a name of SMTP server. It has nothing to do with fixups. What fixup does that it looks for SMTP protocol anomalies and drops connection when something is going wrong. Because SMTP is changing and servers and clients start using new features, or include some new stuff into headers which PIX doesn't understand it drops perfectly fine connections. Actually you need to get your PIX and SMTP server upgraded to the latest version.
0
 
grahamnonweilerCommented:
I believe the version of PIX on the 5510 is the latest version - that aside the particular problem presented by Cisco's SMTP FIXUP is normally due to the way it handles EHLO - in that it more often than not strips out server signatures and on occasions the initial 220/200 codes. So as opposed to the Cisco dropping the connection it is the sending SMTP server that drops the connection as it is not able to verify the receivers signature.


0
The IT Degree for Career Advancement

Earn your B.S. in Network Operations and Security and become a network and IT security expert. This WGU degree program curriculum was designed with tech-savvy, self-motivated students in mind – allowing you to use your technical expertise, to address real-world business problems.

 
lrmooreCommented:
ASA 5510 does not support FIXUP commands. Instead, it uses inspect policies.
ESMTP inspect is a new feature of the ASA and supports EHLO. However, there are bugs in this in early 7.x versions of asa/pix
0
 
grahamnonweilerCommented:
lrmoore: usefull information - I wasn't sure if the ESMTP policy it was "SMTP" fixup of old! The 5505 uses the same policy inspect rules as the 5510 and I had to disable the policy there.
0
 
smhillCommented:
Wow, this thread just saved me a bunch of trouble.  I just bought a Cisco ASA 5505, and I was having trouble with receiving mail from our external postfix server.  I tried dropping the MTU on the external server, the internal server, and the outside interface of the firewall, but nothing was fixing the problem.  I ran "no fixup protocol smtp 25", as per grahamnonweiler's post, and now it is working without a problem.

Thanks!
0
 
grahamnonweilerCommented:
No objection to deletion, however no points should be refunded as asker never even bothered to respond to any of the experts, and now 2 months later asks for deletion!
0
 
icarus2256Author Commented:
If you read at the bottom of my original question, I found the problem.
I just forgot to delete then.
Will give you full anyway as you did answer correctly.

Thanks.
0
 
funkyone60Commented:
I had this same exact problem that did not start until I upgraded to the latest frimware on my 5510.  I made the change in ASDM as suggested and the problem wnet away immediately- 190 emails in que dropped to 5

Thanks
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

What Kind of Coding Program is Right for You?

There are many ways to learn to code these days. From coding bootcamps like Flatiron School to online courses to totally free beginner resources. The best way to learn to code depends on many factors, but the most important one is you. See what course is best for you.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now