having an ASA 5510 (8.3(2)).

2 Interfaces: 1. NGCC, SecurityLevel 20, one Host with IP Microsoft ESMTP MAIL Service, Version: 8.5.9600.16384 on Port 25 2. DMZ, Security Level 20, one Host with IP Postfix 2.6.6 on Port 25

ESMTP Inspection is enabled (global_policy/inspection_default)

Trying to connect from a Network with Security Level 50 using telnet 25 shows me the SMTP Banner and i can use e.g. EHLO/HELO without problems.

telnet 25 gives me the 220 **** Banner and only 500 5.3.3 Replies regardless of the command i send. Until i disable ESMTP Inspection, then telnet 25 works fine.

The Network i'm connecting from does not have any ACLs or NAT Rules between the one or the other destination network.

What am i missing ? Why is this working on one Interface but not on the other ?


  • 1
    Heed the internet's collective wisdom: turn that broken crap off. I've never seen it work right, and it interferes with everything.
    – Ricky
    Commented Sep 3, 2015 at 7:42
  • Thanks, i already did that. I was just curious why one interface is working and the other one not. Same config except for the IP
    – unficyp
    Commented Sep 3, 2015 at 9:23
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Aug 12, 2017 at 5:30

1 Answer 1


Everything being done by the ESMTP inspection is related to the information being exchanged between hosts. It is not related to NAT, ACLs, IPs or interfaces the client and server reside on with one exception: One of the interfaces the traffic is traversing has the inspection rule turned on or it is globally turned on for all interfaces.

The information being sent between hosts will be modified if it doesn't match the criteria the ASA expects or if it sends information the ASA wants to mask between parties.

More info can be found in the config guide.

Reason for 220 Banner Modification

Another security feature used by these devices is SMTP banner modification. In order to hide the type and version of the protected mail server, some devices will obscure all but the 220 portion of the banner that is required for communication. The banner will often appear similar to: 220*************

Part of the information being hidden is the ESMTP advertisement in the banner. When this advertisement is removed, a sending server will not be aware that ESMTP commands are accepted.


You can also disable just the banner modification.

policy-map type inspect esmtp new_estmp_inspect_map
    no mask-banner

policy-map global-policy
  class class-default
    inspect esmtp new_esmtp_inspect_map
service-policy global-policy global


Reason for Replies

The ASA only supports 15 SMTP commands, any others will return the errors you are seeing. The second SMTP server ( is using commands the ASA doesn't support or they are improperly formatted.

ESMTP application inspection adds support for extended SMTP commands, including AUTH, EHLO, ETRN, HELP, SAML, SEND, SOML, STARTTLS, and VRFY. Along with the support for seven RFC 821 commands (DATA, HELO, MAIL, NOOP, QUIT, RCPT, and RSET), the ASA supports a total of 15 SMTP commands. Other extended SMTP commands, such as ATRN, ONEX, VERB, and CHUNKING, and private extensions are not supported. Unsupported commands are translated into Xs, which are rejected by the internal server. This results in a message such as "500 Command unknown: 'XXX'." Incomplete commands are discarded.


To verify, I recommend using a packet sniffer between the ASA and to see which commands are being returned.

  • Thanks, i found this in the docs already but that doesn't explain why i see 220 ****** right after a telnet to i didnt send a single command. I dont understand where the difference between and (or the interfaces between) is except that the one is MS and the other one is postfix. the only thing that comes into my mind: Is it possible that the ASA checks the Hostname / IP ? is internal without any DNS entry, has valid DNS records.
    – unficyp
    Commented Sep 4, 2015 at 10:51
  • Updated to explain the banner modification. Commented Sep 4, 2015 at 11:15
  • I also added a bit explaining why it modifies traffic in general. Commented Sep 4, 2015 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.