How To Use Fixup Protocol SMTP in Cisco ASA 5510

Posted on 2007-11-17
Medium Priority
Last Modified: 2013-11-30
We have been having issues with Bounced Emails at random and mostly Gmail getting bounced to our Exchange server. We are using Microsoft's FrontBridge Filtering service. They have reccomended the foillowing:  
I have contacted our operations and we were able to determine that this issue that you are experiencing with the deferrals may be due because you are using a Cisco firewall. At this time there is a known compatibility issue between Cisco and Postfix. In order to get this resolved you may want to disabled the fixup protocol on the SMTP.
For further questions in regards to this issue you may want to visit the following link http://support.microsoft.com/kb/295725. Please note that when we do a telnet session we receive the following:

My question, I cannot figure out how to disable the postfix or fixup command. I have tried using this string at the command prompt after ENABLING:  FIXUP PROTOCOL SMTP.
There does not appear to be any command for FIXUP.
I dont see anything on the ASDM GUI either.

** UPDATE **

I was forgetting to issue the: CONFIG T command.
I now was able to issue the FIXUP command and disable the feature.

I would like to get any and all input on this issue if there are others that have some advise.

Please advise.

Question by:icarus2256
LVL 16

Accepted Solution

grahamnonweiler earned 500 total points
ID: 20305791
To remove "fixup" on SMTP...

If you have access to ASDM then:

Configuration --> Service Policy Rules -->  General/Global Policy --> Edit ---> Rule Actions --> Untick ESMTP

Click OK --> Apply --> Save

If you do not have ASDM (which I would recommend you get as it really does save a lot of time) then the PIX CLI is:

conf t
no fixup protocol smtp 25
wr me

LVL 11

Expert Comment

ID: 20305859
I think CLI is perfectly fine.
Just my 2 cents. Postfix is a name of SMTP server. It has nothing to do with fixups. What fixup does that it looks for SMTP protocol anomalies and drops connection when something is going wrong. Because SMTP is changing and servers and clients start using new features, or include some new stuff into headers which PIX doesn't understand it drops perfectly fine connections. Actually you need to get your PIX and SMTP server upgraded to the latest version.
LVL 16

Expert Comment

ID: 20305921
I believe the version of PIX on the 5510 is the latest version - that aside the particular problem presented by Cisco's SMTP FIXUP is normally due to the way it handles EHLO - in that it more often than not strips out server signatures and on occasions the initial 220/200 codes. So as opposed to the Cisco dropping the connection it is the sending SMTP server that drops the connection as it is not able to verify the receivers signature.

Identify and Prevent Potential Cyber-threats

Become the white hat who helps safeguard our interconnected world. Transform your career future by earning your MS in Cybersecurity. WGU’s MSCSIA degree program was designed in collaboration with national intelligence organizations and IT industry leaders.

LVL 79

Expert Comment

ID: 20307234
ASA 5510 does not support FIXUP commands. Instead, it uses inspect policies.
ESMTP inspect is a new feature of the ASA and supports EHLO. However, there are bugs in this in early 7.x versions of asa/pix
LVL 16

Expert Comment

ID: 20307275
lrmoore: usefull information - I wasn't sure if the ESMTP policy it was "SMTP" fixup of old! The 5505 uses the same policy inspect rules as the 5510 and I had to disable the policy there.

Expert Comment

ID: 20315323
Wow, this thread just saved me a bunch of trouble.  I just bought a Cisco ASA 5505, and I was having trouble with receiving mail from our external postfix server.  I tried dropping the MTU on the external server, the internal server, and the outside interface of the firewall, but nothing was fixing the problem.  I ran "no fixup protocol smtp 25", as per grahamnonweiler's post, and now it is working without a problem.

LVL 16

Expert Comment

ID: 20838568
No objection to deletion, however no points should be refunded as asker never even bothered to respond to any of the experts, and now 2 months later asks for deletion!

Author Closing Comment

ID: 31409748
If you read at the bottom of my original question, I found the problem.
I just forgot to delete then.
Will give you full anyway as you did answer correctly.


Expert Comment

ID: 37134695
I had this same exact problem that did not start until I upgraded to the latest frimware on my 5510.  I made the change in ASDM as suggested and the problem wnet away immediately- 190 emails in que dropped to 5


Featured Post

Get Certified for a Job in Cybersecurity

Want an exciting career in an emerging field? Earn your MS in Cybersecurity and get certified in ethical hacking or computer forensic investigation. WGU’s MSCSIA degree program was designed to meet the most recent U.S. Department of Homeland Security (DHS) and NSA guidelines.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For months I had no idea how to 'discover' the IP address of the other end of a link (without asking someone who knows), and it drove me batty. Think about it. You can't use Cisco Discovery Protocol (CDP) because it's not implemented on the ASAs.…
Check out the latest tech news, community articles, and expert highlights in August's newsletter.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses
Course of the Month9 days, 2 hours left to enroll

621 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question